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During this study, principal measurements and calculations were made in U.S. customary 
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1.0 SUMMARY 


This report documents both the Current and Advanced Active Controls Technology (ACT)' 
System Definition Tasks of the Integrated Application of Active Controls (lAAC) 
Technology to an Advanced Subsonic Transport Project. 

The first part of the report discusses development of an ACT system architecture, based 
on current technology system elements, that best meets the reliability and availability 
requirements. The balance of the report discusses use of optimal control theory for 
analysis and synthesis of the ACT multivariable control laws and the implementation of 
the same ACT functions as the current technology work with advanced system 
components. 

The objectives of the Current Technology ACT System design were to: 

• Define a highly reliable, low technical risk ACT control system for the lAAC 
airplane configurations using current technology 

• Support assessment of the benefit associated with the ACT airplane by evaluating 
reliability, cost, and weight of the current technology system 

0 Identify technical risk areas and recommend system development and testing 

The system architecture work addressed implementation of all potentially beneficial ACT 
functions, not just those employed on a particular airplane configuration. The approach of 
the current technology work was to define and evaluate two extreme system architecture 
forms, then define a "Selected System" that used the best features of extreme forms. The 
principal differences among these systems are the number and organization of the digital 
computers. The Selected System employs three redundant computers to implement all of 
the ACT functions, four redundant smaller computers to implement the crucial pitch- 
augmented stability function, and a separate maintenance and display computer. The 

_9 

reliability objective of probability of crucial function failure of less than 1 x 10 per 
flight of 1 hr can be met with current technology system components, if the software is 
assumed fault free and coverage approaching 1.0 can be provided. There is no generally 
accepted method to prove the software to be error free. However, a disciplined approach 



beginning with functional analysis and proceeding through requirements, design, coding, 
verification, validation, exhaustive testing, configuration control, and documentation has 
been shown, on space and aircraft programs, to be both essential and effective in 
producing highly reliable real-time control software. 

The objectives of the Advanced Technology ACT System design were to: 

• Synthesize the multivariable ACT control laws directly, using time-domain optimal 
control theory 

• Evaluate the effects of actuation system nonlinearities on gust-load alleviation and 
flutter-mode control 

• Determine an ACT control system architecture based on advanced technology (circa 
1990) 

The optimal control theory approach to ACT control law synthesis yielded comparable 
control law performance much more systematically and directly than the classical 
s-domain approach. The ACT control law performance, although somewhat degraded by 
the inclusion of representative noniinearities, remained quite effective. Certain high- 
frequency gust-load alleviation functions may require increased surface rate capability. 
Finally, the use of advanced computers with bus architecture (both potentially available 
circa 1990) has the promise of significant savings in airplane weight and first cost. 
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2.0 INTRODUCTION 


The Integrated Application of Active Controls (lAAC) Technology to an Advanced 
Subsonic Transport Project has three major objectives. The first objective is the credible 
assessment of the benefit to a commercial jet transport airplane of the full application of 
active controls designed into the airplane from the beginning of the airplane program. 
The second objective is identification of the risks associated with the use of Active 
Controls Technology (ACT). The third objective is reduction of these risks to a level 
commensurate with commercial practice, through test and evaluation, to the degree 
possible within funding limitations. 

This project, a part of the NASA-Boeing Energy Efficient Transport (EET) Program, has 
been organized into three major elements as shown at the top of Figure 1. The first major 
element, as shown in the figure, includes establishment of the design criteria appropriate 
for an ACT airplane, design of an ACT airplane configuration to meet the selected 
criteria, design of an ACT control system based upon current technology, and selection 
and evaluation of a Final ACT Configuration. In parallel with these tasks, the Advanced 
Technology ACT Control System element included exploration of more direct control law 
synthesis methods and alternative means of implementing the ACT functions using 
advanced technology, as shown in Figure 2. The final major element of the lAAC Project 
will address the reduction of risk associated with implementation of ACT on a commercial 
transport through test and evaluation activities. Figure 3 shows this final element. A 
more detailed discussion of the lAAC Project Plan is contained in Reference 1. 

This report covers those parts of the lAAC Project shown shaded in Figures 1 and 2. The 
Current Technology Task is discussed in Sections 4.0 through 9.0. The Advanced 
Technology Task is discussed in Sections 10.0 through 14.0. 

Results of the Configuration/ACT System Design and Evaluation Tasks to date have shown 
that when ACT is integrated early into the design of a transport aircraft, significant fuel 
savings can be realized. It was previously reported (ref 2) under this project that 6% to 
6.5% block fuel savings could be obtained with ACT at the design range of about 3700 km 
(2000 nmi) compared to the performance of a Conventional Baseline Airplane (ref 3) with 
the same wing planform (aspect ratio 8.7). When this wing was retailored (to aspect ratio 
12.0 with unchanged area), the fuel savings increased to about 10%, accompanied by 
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Figure 1. Configuration /ACT System Design and Evaluation Element 


increased estimated manufacturing costs (ref ^). These benefits are all based on current 
technology ACT system implementation such as that discussed in Sections k.Q through 9.0 
of this document. 
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Figure 2., Advanced Technology ACT Control System Definition Element 


The Current Technology ACT System Definition work proceeded under the important 
constraint of using only currently available control system technology. There was to be 
no dependence upon technological features that have not been demonstrated as feasible. 
The approach to the current technology system definition has been to perform a 
preliminary design of an ACT system that can provide all of the considered functions with 
appropriate reliability. The configuration definition started with two extreme 
architectural forms chosen to represent the apparent limits of system organization— first, 
with the functions integrated into one set of computers and, second, with the functions 
segregated into separate computer sets. This was followed with comparative evaluation 
of those two systems and the use of that comparison to derive the basic form of the 
Selected System. This third system was then evaluated in the same fashion as the other 
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two systems. In parallel, the feasibility of certain key assumptions was checked in 
computer laboratory work, simulating the digital control computers in single-channel and 
redundant hookups. 

The advanced technology work reported in this document focused on two areas: the use of 
modern optimal control law synthesis techniques and an alternative implementation of the 
same ACT functions treated in the Current Technology ACT System Definition Task. The 
results of the optimal synthesis work are compared with that of the classical s-domain 
work done in support of the Configuration/ACT System Design and Evaluation element. 
The alternative ACT function implementation identified three approaches using varying 
degrees of technical readiness; these approaches are characterized as having low, 
medium, and high technical risk associated with a circa 1990 implementation. A 
derivative of the medium-risk system was selected for further evaluation and cost-of- 
ownership analysis. 
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This document is the complete report on lAAC control systems. Volume I covers the 
current and advanced technology system work accomplished to date. Volume II contains 
appendices to the material of Volume 1- 
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3.0 SYMBOLS AND ABBREVIATIONS 


This section contains five subsections: General Abbreviations, Subscripts, Superscripts, 
Operators, and Symbols. Each subsection is arranged in alphabetical order. For ease of 
reference. Subsection 3.2 is further divided into two parts— velocity and Mach number 
subscripts (3.2.1) and general subscripts (3.2.2). 

3.1 GENERAL ABBREVIATIONS 


ac 

alternating current 

app 

appendix 

apb., 

control law transfer function parameters 

Cpd^, 

control law transfer function parameters 

Pi 

control law transfer function parameters 

A 

ampere; piston area; system state matrix 

AAL 

angle-of-attack limiter 

AB 

address bus 

ACES 

airline cost-estimating system (program) 

ACT 

Active Controls Technology 

A/D 

analog to digital 

AEC 

Atomic Energy Commission 

AFCS 

automatic flight control system 

Ah 

ampere-hour 

AIL 

aileron 

ALU 

arithmetic logic unit 

AP 

autopilot 

APB 

auxiliary power breaker 

APD 

avalanche photodiodes 

APFDC 

autopilot flight director computer 
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APU 

AR 

ARCS 

ARINC 

ASYM 

ATDP 

ATE 

A 

a 

A 

u 

A 


A 

A 


w 

O 

O 


ApA2 

Ai,A2 


bps 

brkr 

b. 

1 

B 

B' 

BIT 

BTB 

BPCU 

B 

a 

B. 

1 

B 

u 


auxiliary power unit 
analog reversion 

Airborne Advanced Reconfigurable Computer System 

Aeronautical Radio Incorporated 

asymmetry detection electronics 

air-turbine-driven pump 

automatic test equipment 

airplane state matrix 

actuator state matrix 

wind state matrix 

steady aerodynamic stiffness matrix 

steady aerodynamic stiffness matrix associated with control 
surface deflection 

unsteady aerodynamic stiffness matrix 

unsteady aerodynamic stiffness matrix associated with control 
surface deflection 

bits per second 

breaker 

unsteady aerodynamic lag coefficients 

control input distribution matrix 

transformed control distribution matrix 

built-in test 

bus tie breaker 

bus power control unit 

airplane control distribution matrix 

bending moment at the ith station 

actuator input distribution matrix 
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c 

eg 

cm 

c 

c. 

1 

C 

C' 

CARE 

CARSRA 

CAS 

CB 

CCDL 

CCDT 

CDC 

CLB 

CLP 

CMOS/SOS 

CONT 

CPU 

CQ 

CRT 

CRZ 

CSEU 


wind input distribution matrix 

input to system matrix for full-state feedback system 
command to input matrix for full-state feedback system 
characteristic chord length 
center of gravity 
centimeter 

mean aerodynamic chord 

Kussner scaling coefficients 

Celsius; state to output distribution matrix 

transformed state to output distribution matrix 

computer-aided reliability estimates 

computer-aided redundant system reliability analysis 

control augmentation system 

circuit breaker 

cross-channel data link 

cross-channel data transfer 

Control Data Corporation 

climb 

control Jaw processor 

complementary metal-oxide semiconductor/silicone on sapphire 
continuous 

central processing unit 
servovalve spool gain 
cathode-ray tube 
cruise 

control system electronic unit 
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i 


CSV 


cv 

cws 


CY 


c 

a 



C 

P 


c 


V 




c 


1 


c 


1 


€ 

d 


d 

dB 

dc 

deg 

d. 

1 

D 

D/A 

DADC 


computer service unit 
control valve 
control wheel steering 
calendar year 

airplane output distribution matrix 

plant process noise covariance matrix 

fictitious input noise covariance matrix 

state to performance output distribution matrix 

actuator output distribution matrix 

measurement noise covariance matrix 

state to wind output distribution matrix 

quasi-steady aerodynamic stiffness matrix 

quasi-steady aerodynamic stiffness matrix associated with 
control surface deflection 

quasi-steady aerodynamic damping matrix 

quasi-steady aerodynamic damping matrix associated with control 
surface deflection 

controllability matrix 

plant disturbance vector; control law transfer function 
denominator 

fictitious input noise 

decibel 

direct current 

degree 

Kussner lag coefficients 

control to output distribution matrix; drag 

digital to analog 

digital air data computer 
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DAST 

DC 

DITS 

DMA 

DN 

DRO 

D. 

1 

D. 


D. 

e 

E 


w 


EASY 

EDP 

EET 

EHV 

ELEV 

EM 

EMA 

EMI 

EMP 


E(p) 

EPC 

f 



fig- 

ft 


drone for aerodynamic and structural testing 
don't care 

digital information transfer system 

direct memory access 

down 

design requirements and objectives 

unsteady aerodynamic matrices to model lift growth effects 
associated with rigid and elastic modes 

unsteady aerodynamic matrices to model lift growth effects 
associated with control surfaces 

direct transmission matrix from wind to output 

base for Napierian logarithms; system state estimate error 

process noise distribution matrix; exponent; wind to output 
distribution matrix 

environmental control analysis system 

engine-driven pump 

Energy Efficient Transport (Program) 

electrohydraulic valve 

elevator 

electric motor 

electromechanical actuator 

electromagnetic interference 

electric-motor-driven pump; electromagnetic pulse 

fit error function 

external power contactor 

longitudinal correlation function 

figure 

feet 
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F 

FAA 

FAR 

FBW 

FCC 

FD 

FH 

FMC 

FMEA 

FO 

FTAP 

FTMP 

FTREE 

g 

g-dump 

Si 

gal 

gen 

G 

GCB 

GCU 

GG 

GLA 

GMPS 

GPIB 

GPM 


Fahrenheit; FMC; force; measurement noise distribution matrix 
Federal Aviation Administration 
Federal Aviation Regulations 
fly by wire 

flight control computer 

failure detection 

flight hour 

flutter-mode control 

failure mode and effect analysis 

fiber optic 

fault tree analysis program 
fault-tolerant multiple processor 
fault tree computer program 

acceleration due to gravity; structural damping coefficient for 
neutral stability; transverse correlation function 

normal acceleration autopilot disconnect 

unsteady aerodynamic lag coefficients 

gallon 

generator 

feed forward gain; feedback gain matrix 
generator circuit breaker 
generator control unit 
device type identifier 
gust-load alleviation 
general-purpose multiplex system 
general-purpose interface bus 
gallons per minute 
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GPS 

global positioning system 

G(s) 

transfer function 

G. 

1 

constants associated with representation of unsteady 
aerodynamic forces 

hr 

hour 

H 

feedback gain; Hamiltonian 

HDC 

device type identifier 

HDP 

device type identifier 

HMOS 

high-performance metal-oxide semiconductor 

HPU 

hydraulic power unit 

Hz 

hertz 

in 

inch 

ips 

inches per second 

I 

identity matrix; input 

lAAC 

Integrated Application of Active Controls Technology 
Advanced Subsonic Transport Project 

lAP 

integrated actuator package 

IAS 

indicated airspeed 

IB 

input bus 

IC 

integrated circuit 

IDG 

integrated drive generator 

IEEE 

Institute of Electrical and Electronics Engineers 

ILD 

injection laser diodes 

ILS 

instrument landing system 

INBD 

inboard 

INOP 

inoperable 

INS 

inertial navigation system 

I/O 

input/output 
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IOC 


IRS 

ISO 

l\ 

3 

3PL 

kg 

km 

kn 

kPa 

kVA 

kW 

k. 

i 

K 

KA 

KAM 

KC 

KD 

KE 

KF 

KFB 

KG 

KL 

KM 

KMA 


input/output controller 

inertial reference system 

International Standards Organization 

integrated injection logic 

input current 

cost function 

Jet Propulsion Laboratory 

kilogram 

kilometer 

knot 

kilopascal 

kilovoltampere 

kilowatt 

gain at the ith control input 

counter value; gain; gain matrix; state estimate error 
covariance matrix; thousand 

amplifier gain; angle-of-attack gain 

model amplifier gain 

servovalve monitor gain 

demodulator gain 

elevator gain 

flutter-mode control gain 

feedback transducer gain 

gust-load alleviation gain 

feedback gain; lever ratio 

maneuver gain 

maneuver-load control aileron gain 
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KME 

K ops 

KQ 

KSV 

KSVM 

KTD 

KU 


K 


ss 


^ 1 / 3 ^ ) 
*^ 2 / 3 ^ ) 

lb 

Ibf 

Ib/in 

Ib/in^ 

L 


LAS 

LAT 

LE 

LED 

LIA 

LIE 

LOAI 

LOAO 

LOF 


maneuver-load control elevator gain 
thousand operations per second 
pitch-rate gain 
servovalve gain 
model servovalve gain 
transducer gain 
speed gain 
filter gain 

steady-state solution to matrix Riccati equation 
modified Bessel functions of the second kind of order 1/3 
modified Bessel functions of the second kind of order 2/3 
pitch angle scaling constant 
pound 

pound-force 
pounds per inch 
pounds per square inch 

dynamic load vector; length; lift; transverse turbulence 
scale length 

lateral/directional-augmented stability 
lateral 

leading edge; left elevator 

light-emitting diode 

left inboard aileron 

left inboard flaperon 

left outboard aileron, inboard 

left outboard aileron, outboard 

left outboard flaperon 
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LR 

LRU 

LSI 

LSIC 

LVDT 


^v,w 

I 

£ 

m 

mA 

max 

min 

mm 

ms 

/iS 

M 

MARG 

MCU 

MCV 

MEL 

MG 

MHD 

MLC 

MMU 


lower rudder 

line replaceable unit 

large-scale integration 

large-scale integrated circuit 

linear variable differential transformer 

three-component vector of L consisting of shear, bending moment, 
and torsion of the ith station 

longitudinal turbulence scale length 

transverse turbulence scale lengths 

liter 

Laplace transform 
meter 

milliampere 

maximum 

minute 

millimeter 

millisecond 

microsecond 

feedforward gain matrix; Mach; mega; motor 
marginal, one failure away from function loss 
modular control unit (ARINC dimension specification) 
main control valve 
minimum equipment list 
main gear 

magnetohydrodynamic 
maneuver-load control 
memory management unit 
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MOS 


metal-oxide semiconductor 


M/R 

MTBF 

MUX 

MVL 

MW 

MZFW+F 

“q 

M 

u 

M„ 

M§^ 

nmi 

ns 

n\np 

n. 

1 

n 

z 

N 

NAV 

NDP 

NG 

NMR 

No. 

ops 

oz 


maximum range to its resolution 

mean time between failures 

multiplexer 

midvalue logic 

megawatt 

maximum zero fuel weight plus fuel (including full reserve tanks) 
dimensional variation of pitching moment with pitching rate 
dimensional variation of pitching moment with speed 
dimensional variation of pitching moment with angle of attack 
dimensional variation of pitching moment with angle-of-attack rate 
dimensional variation of pitching moment with elevator angle 
nautical mile 
nanosecond 

Markov transition rate, stage n between states m and p 
control law transfer function numerators 
vertical acceleration 

dummy vector; newton; ultimate normal load factor 
navigation (mode) 
numerical data processor 
nose gear 

nuclear magnetic resonance 
number . 

speed of the No. 1 rotor 
operations per second 
ounce 

body axis coordinates 
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o 

OAI 

OB 

OEM 

OMP 

OUTBD 

& 

A 

P,P 

psi 

pwr 

P 

Pa 

PAS 

PBW 

PCU 

PCM 

PF 

PIN 

PLIM 

PM 

PROM 

P/S 

PSD 


inertial axis coordinates 
output 

outboard aileron (inboard section) 
output bus 

original equipment manufacture 
output monitor processor 
outboard 

observability matrix 
Lagrange's multiplier 
pounds per square inch 
power 

inertial-to-body transformation matrix; probability; pump 
pascal 

pitch-augmented stability 

power by wire 

power control unit 

power conditioning module 

pump and filter 

p-layer intrinsic n-layer 

nonlinear actuator position limit 

permanent magnet 

programmable read-only memory 

parallel/serial 

power spectral density 

pressure, return 

pressure, supply 

hydraulic supply pressure, hydraulic system 1 
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q 

q 

q 

Q 

QA 

QSAE 

QjQpQ2 

r 

rad 

ref 

rms 

r. 

1 

R 

RADC 

RAM 

RAT 

RE 

RIA 

RIF 

RUM 

ROAD 

ROAI 

ROF 

ROI 


hydraulic supply pressure, hydraulic system 2 

dynamic pressure; perturbation value of pitch rate; rigid 
and flexible modal coordinates 

rigid and flexible mode rates 

rigid and flexible mode accelerations 

unsteady aerodynamic states associated with q 

pitch rate 

device type identifier 
quasi-static aeroelastic 

cost weighting matrices for performance variables 

yaw rate 

radian 

reference 

root mean square 

ith gust input reference coordinate vector 

cost weighting matrix for control inputs; receiver 

Rome Air Development Center 

random-access memory 

ram air turbine 

right elevator 

right outboard aileron 

right inboard flaperon 

nonlinear rate limit 

right outboard aileron, outboard 

right outboard aileron, inboard 

right outboard flaperon 

return on investment 
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ROM 

RPS 

RT 

RTS 

R. 

1 


R.. 

R.. 

ij 

R ,R ,R, 

x’ y’ z 


R 


O 


R 


1 


Rz 

(R(t) 


sec 

subsec 

S 

SAS 

S/C 

SDEU 

S/H 

SIFT 

SKC 

S/P 

SRI 

ss 

SSFD 


read-only memory 
rotor position sensor 
remote terminal 
real-time counter 

unsteady aerodynamic force matrix associated with wind 
disturbance 

cross-correlation function between gust states i and j 
Laplace transform of R^^ 
rotations about x, y, z axes 

steady aerodynamic force matrix associated with wind disturbance 

hydraulic return pressure, system 1 

hydraulic return pressure, system 2 

cross-correlation matrix with time lag 

Laplace variable; second (same as sec) 

second (same as s) 

subsection 

Kalman filter gain matrix; standby 
stability augmentation system 
short circuit 

servodrive electronics unit 
sample and hold 

software-implemented fault tolerance 

Singer-Kearfott Corporation 

serial/parallel 

Stanford Research Institute 

signal selection 

signal selection and failure detection 
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SVDED 

SYNC 

5 . 

1 

t 


t 

0 
T 

TD 

TE 

T/O 

T-R 

TRU 

TTL 

TX/RCV 

T. 

1 

T 

u 

T ,T ,T 
x’ y’ z 

u 

u*,u* 

u 

c 


UART 

UPI 


dead band 

synchronization 

shear force at the ith station 

time limit; time setting; time variable 

final time 

ith column of the transformation matrix T 
initial time 

cycle time; sampling period; similarity transformation matrix 
threshold; transistor 

Teledyne 

trailing edge 

takeoff 

transformer-rectifier 

transformer-rectifier unit 

transistor-transistor logic 

transmitter-receiver 

torsion at the ith station 

control effectiveness scaling matrix 

translations along x, y, z directions 

incremental value of forward-speed component; control input 
vector 

optimal control solutions 
control input command 

longitudinal turbulence (output of Dryden model) 

white noise process for longitudinal turbulence (input to 
Dryden model) 

universal asynchronous receiver/transmitter 
device type identifier 
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UR 

USART 
UTIL-1, -2 

U, V,W 

V 

V. 

1 

V-. 

IJ 

''jj/i 

V 

VA 

V ac 
VC 

V dc 
VFB 
VHSIC 
VLSI 
VLSIC 
V/N 
VOR 
VPB 
VPC 
V/V 
VWRS 
VYRO 

^bias^ 


upper rudder 

universal synchronous/asynchronous receiver/transmitter 

utility bus 

positive integer 

measurement noise vector 

ith system eigenvector 

cross-variance between the ith and jth output variables 

variance of jth output response to ith control input 

steady -state airspeed; true airspeed; variable displacement; 
velocity; volt 

volt-ampere 

volt alternating current 

actuator position command voltage; voltage, common; volts, 
command 

volt direct current 

volts, feedback 

very-high-speed integrated circuits 
very-large-scale integrated 
very-large-scale integrated circuit 
volts per Newton 

very-high-frequency omnidirectional radio range 

volts, pitch, channel B 

volts, pitch, channel C 

verification and validation 

vibrating wire rate sensor 

pitch-rate sensor (trade name) 

bias voltage of channel A 
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V 


bias 


B 

Vu- 

bias^ 

w, wg 
wps 

'^c 
w 


g 


w 

g 

W 

WLA 

W 

n 


A 

X 


W 

^B 

X 

XAH 

XBIAS 

XDED 

X 

q 

X 

u 


bias voltage of channel B 
bias voltage of channel C 
voltage of channels A, B, C 
forward velocity 
wind input vector 
words per second 
white noise wind input 

transverse turbulence (output of Dryden model) 
unsteady gust states 
vertical-speed component; watt 
wing-load alleviation 

white noise process for transverse turbulence (input to Dryden 
model) 

system state estimate vector; system state vector 

estimated state vector 

airplane state vector 

initial state vector 

actuator state vector 

wind state vector 

state vector, body-fixed axis coordinates 
state vector, moving-inertial axis coordinates 
index 

actuator displacement 
null bias 

feedback dead band 

dimensional variation of X force with pitch rate 
dimensional variation of X force with speed 
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ik:i 


X 


wz 


X 


a 



X 

X' 



y 

y 

y 

A 

y 


z 

z 


z 

1 


Z 



Z 

q 

z 

u 


Z 


a 



intermediate state variable for transverse turbulence in Dryden 
model 

dimensional variation of X force with angle of attack 

dimensional variation of X force with elevator angle 

state vector for standard controllable form 

state covariance matrix 

covariance matrix for x(t) 

initial state covariance matrix 

output; output positions; output vector 

output rates 

output accelerations 

estimated sensor output vector 

component of y 

output covariance matrix 

covariance matrix for y(t) 

system modal vector 

vertical velocity 

unsteady aerodynamic states associated with z 
Z transform variable; modal response covariance matrix 
vertical acceleration at body station 922.7 (eg) 
dimensional variation of Z force with pitch rate 
dimensional variation of Z force with speed 
dimensional variation of Z force with angle of attack 
dimensional variation of Z force with angle-of-attack rate 
dimensional variation of Z force with elevator angle 
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3.2 SUBSCRIPTS 


3.2.1 Subscripts Related to Velocity V or Mach Number M 


B gust penetration 

D dive 

e equivalent airspeed 

MO maximum operating 

3.2.2 General Subscripts 


a 

A 

c 

eg 

com 

COL 

D 

E 

f 

FB 


g 

i 

m 

max 

MU 

n 

OAI 

OAO 


airplane model 

aileron; amplifier 

command inputs 

(at) center of gravity 

command 

control column 

demodulator 

elevator 

final time 

feedback 

gust model state 

initial time 

implicit or explicit model 
maximum of 

minimum unstick speed condition 
white noise 

outboard aileron (inboard section) 
outboard aileron (outboard section) 
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R 

ss 

SCS 

SM 

SV 

SW 

u 

UCS 

UM 

UW 

w 


T 

-i 

A 


Det(-) 

E(-) 

exp(-) 

Im(-) 

Re(-) 

sgn(-) 


reduced-order model 
steady-state value of 
steady aero control surfaces 
steady aero model 
servovalve 

steady aero wind gusts 
control actuator model 
unsteady aero control surfaces 
unsteady aero model 
unsteady aero wind gusts 
gust model 


3.3 SUPERSCRIPTS 


transpose of 
inverse of 

auxiliary variable; Kalman filter estimated quantity 
auxiliary variable 
auxiliary variable 


3A OPERATORS 


determinant of 
expected value of 
exponential function 
imaginary part of 
real part of 

signum or sign function 
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6 (-) 
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a 


a 


wc 


(3 

r 


r, r 

’ a 

8 

8 


8 


A 


8 


A 

c 


8 


c 


8 


c. 

1 


8 


E 




impulse function 

derivative with respect to time or rate of change (superscript) 

acceleration or second derivative with respect to time 
(superscript) 


3.5 SYMBOLS 


zero matrix 
centerline 

angle of attack; prescribed degree of stability 

difference between airplane angle of attack with respect to the 
air and ideal model angle of attack 

sideslip angle 

disturbance distribution matrix, gamma function 
gust distribution matrix 

control surface command; control surface vector 

steady aerodynamic states associated with 8 

commanded aileron angle 

outboard aileron command 

column angle; control column deflection 

ith control surface command 

commanded elevator angle 

intermediate state variable elevator actuator 

elevator deflection command 

ith control surface position 

ith control surface rate 

ith control surface acceleration 

Kronecker delta 
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change in quantity 
difference in pressure 
state estimate error vector 
damping ratio 
fraction of semispan (2 y/b) 

incremental pitch angle; input matrix in modal coordinates 
(discrete time); pitch attitude; pitch-rate sensor output; 
surface angular position 

phase at the ith control input 

unsteady aerodynamic states associated with B 

failure rate 

ith system eigenvalue 

diagonal or block diagonal state matrix 

micro 

spatial separation vector 

flexible mode displacements 

mean rms turbulence intensity 

discrete gust intensity 

real part of the complex eigenvalue X ^ 

longitudinal rms gust intensity 

transverse rms gust intensity 

time lag; time constant 

time constant of filter 

roll attitude 

mode shape matrix at ith station; output mode shape matrix; 
state transmission matrix in modal coordinate (discrete time) 

load distribution matrix 
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oi frequency, radians 

cjj imaginary part of the complex eigenvalue Xj 
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4.0 CURRENT TECHNOLOGY ACT SYSTEM DEFINITION: TASK OVERVIEW 


Section 2.0 described the relationship of the Current Technology Active Controls 
Technology (ACT) System Definition to the Integrated Application of Active Controls 
(lAAC) Technology to an Advanced Subsonic Transport Project as a whole. This section 
provides a brief overview of the current technology control system work, showing its 
foundation, organization, approach, and progress. Sections 5.0 through 9.0 cover that 
same work in greater detail. Section 5.0 states the rules under which the study was 
performed. Section 6.0 describes the Integrated and Segregated Systems and their 
evaluation leading to the Selected System. The Selected System is defined in more detail 
in Sections 7.0 and 8.0, and its evaluation is reported in Section 9.0. 

4.1 OB3ECTIVES 

The objectives of the Current Technology ACT System Definition are as follows: 

• Define a highly reliable and low technical risk ACT control system for the ACT 
airplane configuration using current technology 

• Support the assessment of the benefit associated with the ACT airplane by 
evaluating reliability, cost, and weight of the current technology system 

• Identify technical risk areas and recommend hardware development and testing 

The ACT functions are designed to be transparent to the flight crew except for mode 
control in the presence of ACT system faults. Certain functions are critical and some 
may be crucial, as those terms are defined in Subsection 4.3. These safety factors and the 
consequent dispatch implications make reliability a key requirement of this equipment. 

The system design was aimed at incorporating all active control functions that could 
contribute significantly to fuel savings in a transport airplane design. Concurrent with 
this "worst case" system evolution, specific current technology systems were defined to 
support the Initial ACT Configuration (ref 2) and the Wing Planform Study Configuration 
(ref 4). 


it.2 GUIDELINES 


The following guidelines were established early in the current technology system work: 

• Assume a set of ACT functions and control surfaces 

• Provide maximum function survivability 

• Isolate hardware and software by criticalities, where feasible 

• Test all dispatch-critical ACT functions prior to takeoff 

• Provide in-flight operation similar to conventional airplanes 

• Use on-condition maintenance 

In identifying ACT functions for this project, all active control functions that would add 
to airplane efficiency were considered. Thus the control system definition work identified 
a broad list of functions, including some that could require new control surfaces. These 
assumed functions are listed in Subsection 4.3. 

Reliability is the key feature. The ACT functions are of varying criticality; isolation of 
any function requiring very high reliability is very desirable. All functions must be tested 
at preflight. The problem is to keep the incidence of delays and cancellations below an 
acceptable maximum level while meeting the reliability standards corresponding to the 
criticality of the functions. 

Because active controls are transparent to the crew, normal in-flight operation will 
involve no special attention to the active controls, thus permitting pilots to fly the 
airplane in the customary manner. 

The policy of on-condition maintenance (that which arises from "flight squawk" or other 
fault report, as opposed to scheduled maintenance) is essential to minimize the ongoing 
maintenance cost. 

An important corollary to these guidelines is illustrated in Figure 1, which shows the 
time-phased relationship of the tasks of the Configuration/ ACT System Design and 
Evaluation element of the lAAC Project. In normal control system design, airplane 
performance characteristics are the basis for determining the control system require- 
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merits. As Figure 1 shows, in the lAAC Project the current technology control system 
work began before there was an ACT airplane configuration and therefore had to proceed 
substantially independent of the airplane design work. For that reason, the control system 
work has not been tied to any specific airplane configuration; rather, it is aimed at 
providing all the active control function capability that might reasonably be required by a 
most-demanding ACT airplane design, which is one that can use all of the ACT functions 
assumed. 


4.3 ACTIVE CONTROL FUNCTIONS 


The active control system will use all of the Baseline Airplane primary control surfaces, 
as shown in Figure 4. In some instances, changes will be made to adapt them to active 
control use while retaining their function in primary control. An example is the split 
outboard ailerons, in which the Baseline Airplane outboard ailerons each become two 
panels, with the smaller inboard panel serving the high-frequency active control function 
of flutter-mode control (FMC), in addition to normal lateral control and wing-load 
alleviation (WLA). 



inner segment 
(WLA, FMC, and 
lateral control at 
low speed) 


Figure 4. Assumed Active Control Surfaces 
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FJaperons also are shown as a feature of the active control system. They were assumed 
necessary for the ACT control system task, whether or not they will ultimately be 
required. 

The active control functions are assumed to be required in the current technology ACT 
system to meet the specification cited in Subsection 4.2. 

The two categories of function criticality represented in Table 1 are defined as follows: a 
crucial function is one whose complete loss results in an immediate unconditional flight 
safety hazard. A critical function is one whose complete loss results in a potential safety 
hazard that can be averted through appropriate pilot action. Using these definitions, 
reliability requirements for each of the ACT functions have been set based on statistical 
data on airplane system failures and the FAA Advisory Circular (ref 5). 


Table 1. Assumed ACT Function Criticality and Reliability 
Requirements 



Criticality 

Reliability 
requirement, 
probability of 
failure per 1-hr 
flight 

Pitch-augmented stability, 
short-period (PASgj^Qp-j-j 

Crucial 

10-9 

Pitch-augmented stability, speed 
(PASgpggp) 

Critical 

10’^ 

Angle-of-attack limiter 
(AAL) 

Critical 

10'9 

Lateral/directional-augmented 
stability (LAS) 

Critical 

10"® 

Gust-load alleviation (GLA) 

Critical 

lO"® 

Maneuver -load control (MLC) 

Critical 

10‘9 

Flutter-mode control (FMC) 

Critical 

lO"® 
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The allowable failure rate of a crucial function makes its reliability essentially equivalent 
to that of primary flight controls in present-day aircraft. The critical function 
probability of failure of 10 ^ per 1-hr flight has been fixed by consideration of 
dispatchability and in-flight operability requirements. 

4.4 ORGANIZATION OF WORK 

Work on the ACT control system has included a number of tasks; Figure 5 shows them as 
they relate to one another. The central horizontal row of boxes may be thought of as the 
mainstream effort, with the smaller boxes above and below representing supporting 
operations. The arrows are only partly indicative of the interrelationships; in particular, 
the evaluation work and the boxes representing the supporting tasks apply to all three of 
the system studies and not just to the Selected System. 

The choice of two extremes of control system form (fig. 6) is based upon the recognition 
that this would identify the limits of most of the major variables that must be considered 
in forming the system concept. The Integrated System depends upon a single set of 
control computers to perform all active control functions. Digital flight control 
computers that have speed and capacity adequate for this central computer task are in 
production now. 

The Segregated System depends upon multiple individual sets of control computers, one 
set for each active control function. This results in more computers, although they can be 
lower performance machines using microprocessors. 

The third system is the Selected System, a merger of features of the Integrated and 
Segregated Systems. It represents the best compromise of advantages and disadvantages 
of the first two systems studied. 

4.5 STATUS AND PLAN 

The system work accomplished to date shows that it is feasible to implement these ACT 
functions using current technology system components and meet the reliability require- 
ments. Considerable development and test work must be completed before the perceived 
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Figure 5. Current Technology System Task Overview 
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risks of such systems are reduced to a level commensurate with current commercial 
practice. The major unresolved issue with respect to digital implementation of these 
critical systems is software verification and validation. There is no generally accepted 
method to prove the software to be error free. However, a disciplined approach beginning 
with functional analysis and proceeding through requirements, design, coding, verification, 
validation, exhaustive testing, configuration control, and documentation has been shown 
to be both essential and effective in producing high-reliability real-time control software. 

During the course of this project, a number of risk areas have been identified that require 
specific development and test for resolution. The final element of the lAAC Project 
(previously shown in fig. 3) will address this work. 

It is expected that piloted simulations of the ACT airplane will be required to ensure that 
these systems are appropriate for a commercial transport and exhibit acceptable 
characteristics in the presence of failures. 

Technical risk concerns may well surface in many different areas of an ACT system, and 
some of these concerns may not be resolved without flight test. Boeing intends to 
proceed toward that goal with the developmental activities identified for this project 
element to the maximum extent permitted by available resources. 
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5.0 ASSUMPTIONS AND DESIGN GROUND RULES 


This section presents the ground rules imposed on the system design task and the 
assumptions made for the Active Controls Technology (ACT) airplane performance 
capability. The first ground rule of this task was to design the ACT system using only 
currently available hardware technology. Other ground rules were derived from 
Appendix A of Reference 2. 

In addition to the ground rules, this section presents the various assumptions made for the 
characteristics of the ACT airplane. Knowledge of the detailed airplane characteristics is 
a prerequisite of normal flight control system design. However, because this system 
design proceeded in parallel with the airplane configuration design, it was necessary to 
estimate many airplane characteristics to support the system design. This was done early 
in the project history by a group of experienced engineers representing the several 
technical disciplines involved. Their collective engineering judgment of the effect of 
losing ACT functions, individually and in combinations, became the basis for the 
configuration-dependent portions of this section. 

5.1 ASSUMED ACT FUNCTIONS 

This subsection describes the active flight control functions assumed to be implemented in 
the ACT control system. These functions rather naturally group themselves into airplane 
mode control and structural mode control. Airplane mode control tends to be low 
frequency and involves traditional stability augmentation functions. Structural mode 
control may include both low-frequency functions (maneuver-load alleviation) and higher 
frequency functions (flutter-mode control and gust-load alleviation). Functions included 
to protect the airplane from entering stall condition are considered a part of ACT, 
although they do not operate in a continuous closed-loop mode. 

The functions selected for the system design are described in Subsections 5.1.1 and 5.1.2. 
Subsection 5.1.3 presents the system organization. 
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5.1.1 STABILITY AUGMENTATION 


Inclusion of augmented stability functions allows relaxation of the inherent airplane 
stability, which results in reduced empennage surface areas with attendant benefits in 
performance. The following such functions are incorporated: 

• Pitch-Augmented Stability (PAS) — For the design study, it is assumed that the 
horizontal stabilizer surface area is reduced substantially below Baseline size, and 
center-of-gravity range is chosen such that the unaugmented airplane would exhibit 
negative stability characteristics throughout the flight envelope. A PAS function is 
therefore required to augment airplane longitudinal stability to provide the desired 
safety and handling quality. PAS includes both short-period and speed stability 
modes defined in Subsection 6.1. 

• Lateral/Directional-Augmented Stability (LAS) — The Baseline Airplane lateral/direc- 
tional characteristics are such that a yaw damper is required for good handling 
quality. It is assumed that there will be little or no reduction in the ACT airplane 
vertical fin size because the size is determined by the low-speed asymmetric power 
control requirement. Consequently, the handling quality improvement required 
above the unaugmented airplane characteristics will be similar to that required for 
the Baseline Airplane. The LAS function required for the ACT airplane will include 
the yaw damper and turn coordination functions. 

• Angle-of-Attack Limiter — The ACT airplane is assumed to have "locked in" stall 
characteristics at high post-stall angle of attack because of the reduced T-tail 
horizontal control surface area, a factor not characteristic of the Baseline Airplane. 
The AAL function consists of two subfunctions: 

• Stick Shaker — The stick shaker warns the pilots by shaking the column and 
providing audio warning when the airplane approaches a stall. 

• Stick Pusher — The stick pusher prevents the ACT airplane from entering a deep 
stall condition by sensing angle of attack and adding an airplane nose-down 
force on the control column. 
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5.1.2 STRUCTURAL LOAD CONTROL 


Control of structural loads in the ACT airplane is limited to the wing loads. There is no 
plan to incorporate systems to control fuselage or empennage structural loads. 

• Wing-Load Alleviation (WLA) — The WLA functions have the objective of redistrib- 
uting and/or reducing loads by suitable deflection of control surfaces. The resultant 
benefit is wing weight reduction through reduced structural design loads. WLA 
consists of two submodes: 

• Maneuver-Load Control (MLC) — load redistribution in response to maneuvering 
flight and flight through atmospheric turbulence, principally in the low- 
frequency spectrum 

• Gust-Load Alleviation (GLA) — alleviation of loads generated by flight through 
atmospheric turbulence, principally in the high-frequency spectrum 

• Flutter-Mode Control (FMC) — FMC suppresses wing flutter from dive speed 

to 1.2 Vq/Mq by commanding appropriate control surface motions. The ACT 
airplane will be flutter free to Vj^/Mj^ without FMC. The FMC system increases 
modal damping at the flutter frequency and actively suppresses the flutter mode. 

5.1.3 ACT SYSTEM ORGANIZATION 

A block diagram of the system incorporating the preceding ACT functions is shown in 
Figure 7. The control laws upon which it is based were developed as part of the airplane 
design using traditional design technique. 

5.2 GENERAL DESIGN GROUND RULES 


5.2.1 DEFINITIONS 

This subsection defines those terms concerned with criticality of function and system 
failures. 
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3.2. 1.1 Flight Criticality 


The following terms define flight criticality. 

• Flight Crucial — that function whose complete loss inevitably results in loss of the 
aircraft. The consequence of complete function loss cannot be averted by procedure 
change or flight envelope restriction. 

• Flight Critical — that function whose complete loss in a specific portion of flight 
could result in loss of aircraft, but such loss could be averted by proper flight crew 
action. 

• Nonflight Critical — that function whose complete loss has no impact on flight safety, 
but the function is considered necessary for some other requirement such as 
passenger comfort in rough air. 

• Dispatch Critical — that function without which an airplane cannot legally be 
dispatched on a revenue flight. 

• Workload Relief— that function that impacts neither flight dispatch status nor flight 
plan but that has convenience value to flight crews. Loss of function may affect 
precision or economy of flight but has no significant effect on safety. 

5.2. 1.2 Failure Survivability 

This subsection defines the terms concerned with system failures. 

• Fail-Operational/Fail-Operational— A fail-operational/fail-operational configuration 
is designed to withstand at least two independent failures and continue to function 
at the specified level of performance. 

• Fail-Operational — A fail-operational configuration is designed to withstand any 
single failure and continue to function at the specified level of performance. 
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• Fail-Safe — A fail-safe configuration is designed such that any failure, or any 
combination of failures not shown to be extremely improbable, will not cause 
transients that exceed airplane structural limits or conditions from which a pilot 
with average skill cannot safely recover. Control surfaces will maintain a safe 
position after failure. The affected function(s) may no longer be available. 

5.2. 1.3 Reliability Requirement 

The criticality defined in Subsection 5.2. 1.1 must be interpreted in terms of reliability 
figures prior to the system design. The reliability requirement of a crucial function is 
explained in Federal Aviation Regulation (FAR) 25, paragraph 25, 1309(b), as follows: 

The airplane system and associated components, considered separately and in 
relation to other systems, must be designed so that the occurrence of any 
failure condition which would prevent the continued safe flight and landing of 
the airplane is "extremely improbable." 

Figure 8, from the FAA Advisory Circular (ref 5), indicates that "extremely improbable" 
should be interpreted as less than 1 x 10 probability of failure per 1-hr flight. 

Defining the reliability requirement of critical ACT functions is more difficult. A 
detailed criticality analysis is needed for the complete flight envelope under various 
conditions to determine that reliability requirement. For this study, the reliability 
requirement of each ACT function was determined by engineering judgment considering 
the functional criticality and the data in Figure 8. In general, the failure consequence of 
a critical ACT function can be defined in the range between "concern" and "emergency 
procedures" in Figure 8. In some specific portion of the flight envelope, the function may 
be in the "catastrophic total loss" category (e.g., FMC for airspeed above Vj^). For this 
study, the reliability requirement of a critical function is defined as follows: 

• General reliability requirement for critical ACT functions: failure probability 
= 1 X 10 per 1-hr flight 


46 



Probability of occurrence per 1-hr flight 



Figure 8. Relationship Between the Consequence of Failure and the Probability 
of Occurrence 


• Reliability requirement for critical ACT functions at specific crucial conditions: 
(probability of function loss) x (probability of encountering specific condition) 
= 1x10^ per 1-hr flight 


5.2.2 GROUND RULES FOR SYSTEM DESIGN 


The follo.wing items are ground rules for system design. 


• The system shall be designed to reconfigure automatically in case of component 
failures to retain ACT functions as long as possible. 
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• In general, a minimum of two channels is required for operation of the ACT 
functions; i.e., the cross-channel comparison technique is used to detect failures. 
Single-channel operation may be permitted only under the following conditions: 

• Adequate self-monitor can be provided in the system. 

• In case of self-monitqr failure, the pilot is able to detect system failure by 
other cues such as airplane response time, damping, etc. 

• Without degrading system performance, authority and rate limits can be 
applied to the actuators to prevent airplane structural damage in case of 
hardover or oscillatory failures. 

O As an objective, the ACT functions shall be isolated in hardware and software in 
accordance with their criticalities to prevent failure propagation and to avoid 
extensive requalification test of functions other than those repaired. 

• Redundant hardware and software elements in the system (serving the same ACT 
functions) shall be interchangeable. 

• As an objective, fly-by-wire techniques shall be used wherever benefits may be 
realized by the integration of primary flight control and the ACT control system. 

• It shall be an objective to integrate the ACT system with other dispatch-required 
flight control systems wherever benefits may be realized in terms of weight, 
reliability, and cost. 

e The system shall be designed for the most demanding ACT airplane configuration 
anticipated from the system design point of view. Data from appendix A of the 
Initial ACT Configuration (ref 2) and Wing Planform Study (ref 4) shall be used for 
the system design where appropriate. 

• If all ac power is lost, sufficient storage battery capacity shall be provided for 
30 min of crucial function operation, and the computers shall operate properly 
without their cooling system for that time. 
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5^.3 GROUND RULES FOR OPERATION 


This subsection lists ground rules for operation of the ACT airplane. 

• In-flight operation of the ACT airplane shall be similar to that of a conventional jet 
transport airplane; i.e., the ACT systems are transparent to flight crews except for 
flight mode control following function loss. 

• In case of system failures in flight, the failure status and operational status in 
accordance with minimum equipment list (MEL) restrictions shall be displayed to the 
flight crew. To assist the pilot in making his decision in response to failure, 
advisory information shall be displayed in an appropriate manner. 

• Degradation of system functions that requires immediate crew response shall result 
in a warning display and aural signal from the baseline aircraft warning system. 

• All dispatch-critical ACT functions shall be tested prior to every dispatch. The 
preflight test shall detect and identify failures to the line replaceable unit (LRU). 
Time required to complete the preflight test shall be minimized. As an objective, 
the time for preflight test shall be less than 2 min. 

• All fault data detected during flight and preflight test shall be stored in nonvolatile 
memory and be available to support maintenance. 

• The results of the preflight test shall be displayed in a manner that shows the failure 
and operational status of the ACT system in accordance with MEL restrictions to 
assist the pilot in making his decision regarding dispatch. 

• The ACT system shall be maintained in accordance with the "on condition" concept. 
Maintenance shall be performed on only those failures identified by preflight test or 
flight squawk (log book). 

• Through-flight maintenance shall be restricted to only those items reported failed 
and required for dispatch. As an objective, through-flight maintenance shall be 
completed within a 20-min period. Any other maintenance may be deferred to an 
overnight stop. 
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5.3 OPERATIONAL CONSIDERATIONS 


A primary design goal of the ACT control system is to configure a system that can be 
operated safely and economically in flight and on the ground in the commercial transport 
environment. This subsection describes design considerations related to safety and 
operability. Subsection 5.3.1 deals with safety, where system criticality and reliability 
requirements become very important. Subsection 5.3.2 describes ACT airplane 
operability, which includes dispatch and flight restrictions when ACT functions become 
inoperative. 

5.3.1 SAFETY AND ASSUMED FUNCTIONAL CRITICALITY 

The safety of the ACT airplane is greatly influenced by the characteristics of the basic 
airplane with the ACT functions inoperative. Knowledge of structural margins and 
stability and control characteristics with the ACT functions inoperative is essential to the 
ACT system design. Because the system design in the lAAC Project proceeded in parallel 
with the basic airplane design, airplane characteristics were estimated as noted in 
Section 5.0 using collective engineering judgment. Based on these estimated character- 
istics, the functional criticality and reliability requirements were defined and are 
described in the following subsections. 

The ACT airplane is assumed to have an aft center of gravity (eg) and a small horizontal 
tail to improve lift-to-drag ratio and to reduce weight. The static and dynamic 
longitudinal instability attributed to the aft eg and the small tail necessitate a PAS 
function to provide acceptable handling qualities. The criticality of PAS is dependent 
upon how far the eg is moved aft and how much the tail size is reduced. For this study, 
the airplane is assumed to be configured so that the short-period-mode PAS is crucial; 
i.e., the airplane will be lost if the short-period PAS fails completely. Speed control PAS 
is critical; i.e., loss of the speed PAS may result in some safety hazard, but it can be 
averted by proper pilot action or flight envelope change. 

In addition to the pitch axis instability, the ACT airplane is assumed to have "iocked-in 
deep stall" that is attributed to the reduced horizontal tail. The AAL function is provided 
to prevent the airplane from getting into a locked-in stall condition. Once the airplane is 
in a locked-in stall, the pilot would be unable to recover from that condition; i.e., the 
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AAL becomes a crucial function in locked-in condition. However, because the 
simultaneous occurrence of complete AAL loss and excessive angle of attack because of 
either a pilot's inadvertent maneuver or atmospheric turbulence is extremely improbable, 
the AAL function is designated as critical. Inadvertent activation of the AAL system 
could result in a disastrous condition; therefore, AAL series devices (subsec 6.1) that 
prevent uncalled-for operation are designated as crucial. 

Lateral control of the ACT airplane is assumed to be similar to conventional airplanes. 
Thus, the LAS function of the ACT airplane is similar to the conventional yaw damper in 
criticality. Complete loss of the LAS in critical flight condition could result in loss of the 
aircraft, but such loss can be averted by proper crew action to restrict the airplane flight 
envelope. Therefore, LAS is designated as critical. 

The WLA function will redistribute and/or reduce the wing loads caused by pilot maneuver 
or atmospheric disturbance. Presence of the WLA function makes it possible to reduce 
wing-box structural material. However, the primary structure of the ACT airplane is 
designed to have sufficient ultimate strength to sustain the design limit load even when 
the WLA function becomes inoperative. This will allow continuation of the normal flight 
schedule after complete WLA loss in the air. The amplane, however, cannot be dispatched 
if the WLA is inoperative. WLA is defined as a critical function. 

The basic ACT airplane is designed with sufficient flutter margin for safe flight to 
Vd/Md without FMC. FMC will keep the airplane flutter free from to 1.2Vj^/Mj^. 

Thus, FMC is a crucial function for airspeed above However, simultaneous 

occurrence of complete FMC loss and airspeed in excess of Vj^/M|^ is extremely 
improbable. Therefore, FMC is defined as a critical function. 

5.3.2 AIRPLANE OPERABILITY WITH ACT FUNCTION LOSS 

Failures of the ACT system may delay or cancel airplane dispatch or restrict flight or 
necessitate diversion to another airport depending upon the nature of the system failure. 
The effect of ACT system failures on airplane operability is one of the important 
economic factors to be considered in the system design. As part of the system design, the 
effect of system failure on airplane operation was analyzed. 
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The assumed airplane performance capability when a single ACT function is completely 

inoperative is described as follows: 

• Short-Period PAS Loss— The airplane will be lost if short-period PAS is lost in the 
air. If the function is lost on the ground, the airplane cannot be dispatched until the 
system is repaired. 

• Speed PAS Loss — The airplane must be operated within a restricted flight envelope 
when speed PAS is lost in the air. If the function is inoperative on the ground, the 
airplane can be dispatched with flight restriction. 

• LAS Loss— The airplane must be operated within a restricted flight envelope when 
LAS is lost in the air. If the function is totally inoperative on the ground, the 
airplane cannot be dispatched because LAS is required for limiting structural loads. 

• AAL Loss — The airplane can continue normal flight schedule after AAL is lost in the 
air; such loss does not degrade airplane handling qualities. However, the pilot will 
be informed of system status and will continue the flight with special caution. If 
AAL is inoperative on the ground, the airplane cannot be dispatched because of loss 
of safety margin. 

• WLA Loss — The airplane can continue normal flight schedule after WLA is lost in the 
air because the airplane structure ultimate strength exceeds the design limit load. 
If WLA is inoperative on the ground, the airplane cannot be dispatched because the 
airplane structural strength is less than the design ultimate load. 

• FMC Loss— Airplane speed must be reduced upon loss of FMC to provide an adequate 
speed margin for upset. If the function is inoperative on the ground, the airplane 
can be dispatched with flight restriction. 

The ACT airplane must meet dispatch requirements as follows: 

• Airplane schedule reliability must be at least 98.7%. Not more than 5 % of the 
unreliability shall be attributable to ACT system failure. 
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• The airplane shall be dispatchable with any one ACT system component failed. 

Subsection 8.4.1 contains a detailed development of the airplane operability based upon 
the preceding consequences of ACT function loss; it includes multiple-function loss 
effects and effects of some partial-function losses that reduce operability. 



6.0 COMPARISON OF SYSTEM DESIGN CONCEPTS 


In preparation for selecting an Active Controls Technology (ACT) system design concept, 
two system architectures were studied using the ground rules and assumptions described in 
Section 5.0. The first step of the study was to design an Integrated System, where all 
ACT functions are processed in the same computer set. This system was designed using 
currently available flight control computer hardware with minimum modification of the 
basic mechanical primary control system. The second step was to design a Segregated 
System, where each ACT function is processed in a separate dedicated computer set. The 
Segregated System computers were designed using currently available large-scale 
integrated (LSI) circuit components. In addition to computer design, an effort was made 
to improve the actuation system. The third step of the study was to define the Selected 
System design concept by combining good features of the Integrated and Segregated 
Systems and the results of the actuation system design work. Finally, a brief study was 
conducted to investigate the benefit of pure fly-by-wire (FBW) pitch axis control, because 
airplane safety had already been made dependent upon the short-period pitch 
augmentation, an FBW control function. 

All the systems studied sense airplane motion and deflect appropriate control surfaces to 
perform the ACT functions. In airplane design, selection of sensor signals and control 
surfaces is an important task, requiring many iterative cycles between the airplane design 
and system design. In the lAAC Project, the sensor signals and the control surfaces 
needed to perform each ACT function were defined in another task, Configuration/ACT 
System Design and Evaluation. The sensor signals, control surfaces, and system 
organization selected in that task are shown in Figure 7. Major tasks of the Current 
Technology ACT System Definition include definition of system configuration, selection 
of sensor hardware, definition of computers, and definition of actuation systems to 
implement the ACT functions and meet the requirements of system safety and economical 
operation. 

Subsection 6.1 describes the Integrated System, and Subsection 6.2 describes the 
Segregated System. Subsection 6.3 compares these two contrasting concepts and 
describes the Selected System design concept. Subsection 6A briefly describes the 
Selected System. Finally, Subsection 6.5 describes the pitch axis FBW system and 
compares this system with a conventional cable system. 
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6.1 INTEGRATED SYSTEM 


The Integrated System employs a single computer set to process the five ACT functions: 
pitch-augmented stability (PAS), angle-of-attack limiter (AAL), lateral/directional- 
augmented stability (LAS), wing-load alleviation (WLA), and flutter-mode control (FMC). 
PAS consists of short-period and speed (phugoid) mode control. It was assumed that the 
short-period PAS is a crucial function (i.e., loss of the function results in loss of the 
airplane) and that the speed PAS is critical (i.e., loss of the function may result in a flight 
safety hazard, but it can be avoided by appropriate flight crew actions). The crucial 
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function must meet the failure rate requirement of less than 1 x 10 per 1-hr flight. A 
reliability analysis was conducted on the short-period PAS to select appropriate 
redundancy for each element to meet the reliability requirement. The results indicated 
that the short-period PAS requires four channels to meet the specific reliability 
requirement; this established the requirement of four central computers. 

Figure 9 is a block diagram of the Integrated System. Figure 10 shows the location of 
system sensors. 

The system shares the triple digital air data computer (DADC) and the triple inertial 
reference system (IRS) with the autopilot and display functions. These two sensors 
provide multiple signals for the ACT functions via Aeronautical Radio Incorporated 
(ARINC) 429 digital communication links. A dedicated pitch-rate sensor, used in 
conjunction with the triple IRS, serves to implement the quadruply redundant short-period 
PAS function. The remaining dedicated sensors; i.e., accelerometers at several wing 
locations, provide triply redundant analog signals for WLA and FMC functions. The 
sensors are coupled to their assigned digital computers, where data are then transmitted 
to other computers over cross-channel communication links to satisfy the redundancy 
requirement. These links are dedicated one-way, high-speed data buses. It should be 
noted that all four computers receive all sensor signals via the cross-channel 
communication link even though one of the computers is not directly connected to a 
sensor. Triply redundant critical sensors are connected to the four computers in a manner 
that minimizes the probability of multiple-function loss with two computer failures. 

Each computer consolidates all input signals (analog, digital, and discrete) in a signal 
selection and failure detection (SSFD) process. The signal selection process uses midvalue 
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selection for three sensor signals and average value selection for two sensor signals. A 
four-sensor set is treated as three with one operating standby. The failure monitor is a 
dynamic and static comparison of inputs and selected signal to single out any value that is 
inordinately different from the selected value. Because the Integrated System computers 
process many ACT functions that require different redundancy levels depending upon 
function criticality and failure conditions, the SSFD process is varied as necessary to 
handle the different types of sensor signals. 

The Integrated System computers are frame synchronized such that each executes the 
same function essentially at the same time. Using the SSFD process and frame 
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Figure 10. ACT Sensor Placement 


synchronization, the quadruple computers transmit nearly identical command signals to 
the ACT actuators, reducing force fighting in the actuation system and simplifying the 
failure detection algorithm for passive failures. 


The architecture of the Integrated System computer retains many of the Airborne 
Advanced Reconfigurable Computer System (ARCS) (ref 6) features, such as the bus- 
oriented structure, autonomous input/output operation, and microprogrammed control 
processing. The basic change from the ARCS to the integrated computer is in partitioning 
crucial and critical functions. This change is essential because of the extremely high 
reliability required of the crucial function. Comprehensive self-testing capability is 
provided to meet flight safety requirements and support maintenance. Self -test features 
include monitoring of internal power supplies, machine timing, processor capability, 
memory operation, and input/output operation. Specific tests include program memory 
sum checks, parity checks, arithmetic overflow detection, and wraparound testing of 
analog and discrete input/output. 
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The redundant command signals generated in the quadruple computers are sent to the 
various control surfaces through the ACT actuation systems. The signals are consolidated 
at the actuators to perform mechanical voting. Three actuator configurations are used in 
the Integrated System design: ACT secondary actuator configuration, ACT dedicated 

force-displacement summed actuator configuration, and stick pusher actuator 
configuration. 

ACT Secondary Actuator Configuration- A side-by-side force-summed secondary actuator 
concept (fig. 11) was chosen for the elevator, rudder, and outboard aileron (outer section) 
actuation systems. The output of the secondary actuator is series summed with the pilot's 
mechanical control signal to form a command input to the power control unit (PCU). The 
PAS and maneuver-load control (MLC) functions use the ACT secondary elevator actuator 
to control the elevator. The command signals of these two functions are summed in each 
of the quadruple computers before sending the signal to the actuator. Three actuators 
provide sufficient reliability to meet the requirements of crucial functions when 
comparison of valve spool position to that predicted by a mathematical model in the 
computer is used to augment cross-channel comparison for failure detection. Similarly, 
two actuators are sufficient for critical functions. Each actuator has a conventional two- 
stage, low-pressure-gain electrohydraulic servovalve operating a single ram. Valve spool 
and ram position are fed back to each ACT computer for servo-loop control and failure 
detection. The mathematical actuator model in each computer receives the summed ram 
position feedback and combines this with the command signal to compute servovalve 
position. 

ACT Dedicated Force-Displacement Summed Actuator Configuration— The force-displace- 
ment summed actuator configuration (fig. 12) was chosen as the PCU for the dedicated 
ACT control surfaces, which include inboard and outboard flaperons and the inner section 
of the outboard aileron. The force-displacement summed actuator was designed to remain 
fully operational with decreased dynamic performance after one electric and one 
hydraulic failure. The actuator configuration is an FBW implementation in that electric 
signals from the computers directly command the control surface. The command signals 
from the computers are magnetically flux summed in the four first-stage electrohydraulic 
servovalves, two per hydraulic system. Each group of two first-stage valve outputs is 
mechanically position summed by a linkage. 
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Figure 12. ACT Dedicated Force-Displacement Summed Actuator Configuration 


The second-stage valve spool is controlled by force summing the resultant mechanical 
output of each first-stage linkage. The second-stage valve-to-main-output ram power 
application is the same as in conventional dual-tandem actuation. 
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Stick Pusher Actuator Configuration— The stick pusher (fig. 13) uses three sensors, four 

computers, a dual-tandem floating actuator, and two pneumatic power sources. The 

actuator exerts the same force when pressurized by either one or both sides. The 

installation linkage is such that the force exerted on the control column continuously 

decreases as it travels forward; 356N (80 Ibf) exerted at the full aft position reduces to 

178N (W Ibf) at the full forward position. Each dual-pneumatic power source consists of a 

2 

nitrogen bottle at 13 788 kPa (2000 Ibf/in ) and a regulator that reduces the pressure to 

2 

3447 kPa (500 Ibf /in ) required for actuation. Two series solenoids, each signaled by an 
ACT computer, must be opened before either actuator is operated. 
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6.2 SEGREGATED SYSTEM 


The Segregated System design concept employs a separate dedicated computer set to 
implement each ACT function. For the Segregated System to be cost effective, a simple, 
inexpensive, and reliable computer is needed. An attempt was made to use LSI technology 
extensively to achieve this goal. The majority of the sensors and all the actuators defined 
for the Integrated System will remain unchanged for the Segregated System. Figure 14 is 
a block diagram of the Segregated System. Nineteen computers are used to compute 
control laws, provide system testing, and monitor for failures of the ACT functions. Two 
ACT Management Computers are added to process crew communication logic and to store 
data on detected faults. 

The crucial short-period PAS is mechanized in dedicated quadruple computers to meet the 
fail-operational/fail-operational requirement. Four dedicated ACT pitch-rate sensors are 
provided to serve the crucial short-period control law. The dedicated pitch-rate sensors 
and dedicated short-period PAS computer essentially separate the crucial function from 
the remaining ACT functions. This separation is desirable considering maintenance, 
testing of the crucial function, and protection from potential propagation of noncrucial 
function failures to the crucial short-period functions. 

The remaining sensors shown in Figure 14 are identical to those of the Integrated System. 
The interface between these sensors and the Segregated System computers is different 
from that of the Integrated System. The triple IRS and DADC sensors are shared by many 
ACT functions, as in the case of the Integrated System. Their signals are sent to each 
segregated computer set via ARINC 429 digital communication links. The triple digital 
signals from the DADC and IRS are dedicated to their respective digital computers in 
each set, where data are transmitted to other channels via cross-channel communication 
links. Each analog sensor is cross strapped to computers; i.e., each analog sensor is 
directly connected to all of the redundant computers. The input signals (digital, analog, 
and discrete) are processed by the signal selection algorithm to create a signal for 
computing control laws and processing other functions. The algorithms are similar to 
those of the Integrated System. Primary failure detection in the Segregated System is 
provided by cross-channel comparison. Cross-channel monitors are provided for sensor 
input, digital computer output, and actuator position, as in the case of the Integrated 
System. 
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Figure 14. Segregated System Configuration 


To keep the Segregated System computers as simple as possible, monitoring is largely 
done in software and additional hardware for inline monitoring is kept to a minimum. The 
computers of the crucial short-period PAS system run asynchronously. Because the 
computers are not synchronized, each samples the input data and computes' the control 
laws at its own time. Thus, outputs of the redundant computers may differ due to time 
skew between them. Feasibility of this asynchronous ACT computer operation was 
studied by simulating the Segregated System in the laboratory. Test results indicate no 
appreciable difference between the -outputs of the synchronous and asynchronous systems. 
It should be noted that the ACT functions described in Subsection 5.1 do not have any 
integrating functions, a key factor in successful asynchronous operation. 


The FMC computer requires the highest sampling rate to process the high-frequency 
filters with acceptable tolerance in phase and gain margin. The WLA computer has the 
most computation to perform because the function has the largest number of sensors and 
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control surfaces among the ACT functions. The short-period PAS is a crucial function and 
requires the highest reliability among the ACT functions. A study was conducted to 
define a microcomputer with speed, word size, and memory suitable for implementing the 
ACT functions. Some of the functions could be mechanized using an 8-bit microprocessor. 
However, to standardize the hardware and thus reduce the overall cost, a 16-bit single- 
chip microprocessor was selected as the Segregated System computer. Table 2 shows the 
requirements of each ACT function computer. The segregated computer has the following 
self -tests: 


• Power monitor 

• Parity check 

• Sum check 


Table 2. Segregated System Computer Requirements 


Function 

Memory requirements 

Sampling 

rate, 

ms 

Minimum 

CPU 

performance 
required, K ops 

Real time 

Test and mainte- 
nance, words ROM 

P^^SHORT 

3100 words ROM 
128 words RAM 

5700 

10 

75 

PASspeed 

2950 words ROM 
128 words RAM 

5350 

10 

60 

LAS 

3750 words ROM 
128 words RAM 

5400 

10 

75 

FMC 

3750 words ROM 
128 words RAM 

5350 

5 

125 

AAL 

3170 words ROM 
64 words RAM 

5350 

10 

55 

WLA 

4750 words ROM 
512 words RAM 

5500 

10GLA 

20MLC 

120 
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6.3 COMPARISON OF INTEGRATED AND SEGREGATED SYSTEMS 


The Integrated and Segregated Systems described in the previous subsections are 
compared to identify advantages and disadvantages of the two contrasting design 
concepts. From the results of the comparison, the Selected System design concept was 
defined. 

The following subsections describe the comparison results. 

6.3.1 PERFORMANCE 

Laboratory tests were conducted to evaluate the performance of the Integrated and 
Segregated Systems. These two schemes were simulated in the laboratory using quadruple 
General Electric MCP-701A flight control computers. Airplane and actuation systems 
were simulated using a Boeing-owned ECLIPSE digital computer and an analog computer. 
The tests included cross-channel communication, synchronization, and SSFD of the 
quadruple Integrated System. These functions were tested open loop and closed loop with 
the airplane and actuator simulator and showed satisfactory results. A study was 
conducted in the laboratory to verify that the integrated computer can process all ACT 
functions without degrading the response. The integrated computers serve all ACT 
functions at their specified sampling rates with margins. 

Asynchronous operation of PAS and FMC was studied using the MCP-701A to simulate the 
segregated computers. Special attention was paid to computer drift during 1-hr flights. 
There was no appreciable difference between the synchronized and asynchronized 
computer outputs after computing the PAS and FMC control laws for 1 hr. If the control 
laws had an integration algorithm, the asynchronous system might drift and need some 
equalization between the channels. The survey of available microprocessors concluded 
that current models are acceptable for segregated ACT application. 

6.3.2 WEIGHT ANALYSIS 

Because 19 computers are used to implement the segregated ACT functions, the weight of 
the Segregated System increased considerably as shown in Table 3. Four dedicated pitch- 
rate sensors were used in the Segregated System, but their weight is insignificant 
compared with that of the computers. 
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Table 3. Comparison of Integrated and Segregated Systems 


System 

Item 

Integrated 

System 

Segregated 

System 

Computer weight 

4 control computers 

19 control computers at 6 kg 


at 11.3 kg ,(25 lb) 

(13.25 lb) each 


each 

2 management computers at 
2.7 kg (6.0 lb) each 


Total: 45.4 kg(10(]llb) 

Total: 119.6 kg (263.8 lb) 

Memory requirement 

32K ROM 

16K ROM and 64- to 512-word 


2K RAM 

RAM for control computers plus 


(128-word 8-bit non- 

32K ROM and IK RAM and 128- 


volatile memory for 

word 8-bit nonvolatile for 


maintenance information) 

management computer 

Computer reliability 

6800-hr MTBF 

6800-hr MTBF 

(assumed) 

Probability of 

2.5 X 10“^ per 

3.3 X 10”^ per 

restricted flight 

1-hr flight 

1-hr flight 

Probability of 

7.1 X 10”^ per 

2.6 X 10'^ per 

flight diversion 

1-hr flight 

1-hr flight 

Probability of 

3.8 X 10“^ 

1.5x10”^ 

dispatch delay 

per dispatch 

per dispatch 

Incremental cost 



per airplane 
(to airline) 

$274 000 

$390 000 

Expected return 
on investment 

25.1% 

22.8% 


6.3.3 RELIABILITY ANALYSIS 
6.3.3. 1 Flight Restriction and Diversion 

Subsection 8.^.1 describes the functional failure conditions that lead to various flight 
restrictions. Because there are so many elements in the Segregated System, it is 
extremely difficult to assess the probability of occurrence of a flight restriction. The 
computer-aided redundant system reliability analysis (CARSRA) program developed during 
a previous NASA-Boeing program (vol. II, app B, subsec B.1.0, and ref 6) could not deal 
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with the complex problems of predicting flight restriction of the ACT airplane. Instead, a 
computer program for fault-tree analysis developed at Boeing was used for the reliability 
analysis of the ACT system. Subsection 9.2 presents the results of the reliability analysis 
in more detail. 

Table 3 shows the results of predicting flight restrictions and diversions for the Integrated 
and Segregated Systems, assuming the same computer reliability for both. 

Flight restrictions are caused by loss or near loss of individual ACT functions (see 
subsec 8.^.1). The Segregated System, having six sets of computers, has a higher 
probability that a single set will become inoperable and hence a higher probability of 
flight restriction. 

Diversions are caused only by the Essential PAS being one component failure away from 
function loss; or by speed PAS, LAS, and WLA functions all lost; or that same group being 
one component failure away from all lost (see subsec 8.4.1). Because integrated ACT 
functions share one set of computers, multiple computer failures must cause multiple 
function loss. This explains the higher probability of diversion for the Integrated System. 

6.3.3.2 Dispatch Delay and Cancellation 

The method used to predict dispatch delay and cancellation probability is to examine 
dispatch experience of airplanes with components similar to those of the ACT system. If 
the ACT system uses off-the-shelf components, experience delay rates are used. Where 
new hardware, such as the Segregated System microprocessor, is incorporated, experience 
data are modified to account for expected reduction in failure rate. 

Table 3 shows the prediction of dispatch delays and cancellations caused by component 
failures in the Integrated and Segregated Systems. The Integrated System has higher 
dispatch delay and cancellation rates than the Segregated System. 

Another requirement is that the ACT airplane must be dispatchable with any one 
component failed. This requirement is not presently met by either the Integrated or the 
Segregated System. When the system has failures in the crucial function, the airplane 
cannot be dispatched unless the remaining system meets the failure probability 
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requirement of less than 10 per 1-hr flight. When the Integrated System loses one of 
the quadruple computers, or the Segregated System loses one of the quadruple short- 
period PAS computers, the remaining system fails to meet the 10 probability of failure 
per 1-hr flight requirement. The Integrated System requires quintuple redundancy to 
meet the dispatch requirement with one system element failure. The quintuply redundant 
ACT system was considered impractical because of its design complexity. For the 
Segregated System, the problem can be solved if the short-period PAS function is 
duplicated in the speed PAS computers. This approach mixes two different levels of 
criticality in defining the dispatch requirement. 

Another proposed solution is to allow single-channel operation of the crucial short-period 
PAS function. To do this, the system must meet the requirements of Subsection 5.2.2. 
Short-period PAS cannot meet those requirements. 

6.3.3.3 Individual Functional Reliability 

The ACT system must meet the individual functional reliability requirements defined in 
Subsection 5.1. Subsection 9.2 contains the results of reliability analysis of individual 
ACT functions. All functions meet the requirements except WLA, where the requirement 
is 1 X 10~'^ probability of failure per 1-hr flight and the prediction is 1.2 x 10"^. 

6.3.4 COST OF OWNERSHIP 

The Boeing-developed airline cost-estimating system (ACES) computer program was used 
to assess cost-of -ownership differences between the Integrated and Segregated Systems 
when they are installed on the Initial ACT Airplane (ref 6). The program calculates the 
return on investment to the airline considering the system purchase cost, maintenance 
cost, spares inventory cost, fuel burn per hour, weight, drag, etc. Table 3 compares the 
return on investment and incremental cost per aircraft as calculated using the ACES 
program. The Integrated System shows lower ownership cost. Subsection 9.3 presents a 
more detailed analysis of the cost of ownership. 

6.3.5 CONCLUSIONS 

The Segregated System employs separate microcomputers for processing each ACT 
function in the belief that the separate computers would reduce the probability of 
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simultaneous function loss caused by computer failure. The comparison study indicated 
that the benefit in reduction of simultaneous function loss was small compared with the 
increase of purchase cost and maintenance cost, resulting in a lower return on investment 
for the Segregated System, as shown in Table 3. 

It is concluded that the Integrated System concept is the better concept for the ACT 
control system design. There are, however, reservations concerning the Integrated 
System approach (some are common to both systems); these concerns are discussed in the 
following paragraphs. 

Software Design— Computer channels that perform identical ACT functions employ 
identical hardware and software to allow interchangeability. Thus, it is essential to have 
error-free software especially in the crucial short-period PAS function. The approach 
adopted in this task to develop error-free crucial software is to use conventional 
techniques; i.e., simplify the function, adopt appropriate software design techniques such 
as top-down structured programming, conduct rigorous testing including laboratory and 
flight test, and conduct rigorous software error analysis. To conduct rigorous analysis and 
thorough testing, it is very desirable to isolate the crucial hardware and software. This 
approach is less appropriate for the Integrated System, in which both crucial and critical 
software are executed in one set of computers. 

Failure Propagation— Any system that includes flight-crucial functions should be designed 
to prevent noncrucial function failure propagating to crucial functions. This criterion is 
not met by the Integrated System, which mechanizes both critical and crucial functions in 
one set of hardware with some common software. The probability of failure propagation 
is reduced by the separation of crucial computing from critical computing in the 
Segregated System. 

Requalification Test— Extensive and rigorous testing is required after any repair or 
modification whenever crucial functions may be affected. This means any repair or 
modification of the Integrated System computer hardware or software would result in a 
long test time because a crucial function may be affected. This supports using separate 
hardware and software to implement crucial functions. 
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6.4 SELECTED SYSTEM 


The Selected System configuration is shown schematically in Figure 15. It combines 
features of the Integrated System with the advantages of separating the crucial function 
from critical functions. The system uses a triple set of ACT Primary Computers, similar 
to the Integrated System computers, to implement all ACT functions under normal 
conditions. An additional quadruple set of Essential PAS Computers commands and 
monitors the crucial elevator servos and provides backup calculation of the crucial short- 
period PAS control law. These are microprocessor-based computers similar to those used 
in the Segregated System. An additional computer, the ACT Maintenance and Display 
Computer, provides management and communication functions. 


Sensors 
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Figure 15. Selected System Configuration 
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The sensor set for the Selected System is the same as that for the Integrated System, with 
the addition of four dedicated pitch-rate sensors. The Selected System uses new 
actuators for the flaperon and AAL. Actuators for other surfaces are the same as in 
previous systems. A detailed description of the Selected System is contained in 
Section 8.0. 

The Selected System was analyzed and compared to the Integrated and Segregated 
Systems. The results are shown in Table 4. The Selected System yields slightly lower 
return on investment than the Integrated System due primarily to higher initial cost, but 
the Selected System overcomes some of the objections to the Integrated System by 
separating crucial hardware and software from critical. 

The Selected System still does not meet the requirement of dispatchability with any one 
ACT system component failed. After failure of either an Essential PAS Computer or an 
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elevator secondary actuator, the short-period PAS loss probability rises above 1x10 per 
1-hr flight. 


6.5 PITCH AXIS FLY BY WIRE 

A brief study was conducted to assess the benefit of replacing the pitch axis primary 
cable control system with an FBW system. Because pitch axis stabilization by the short- 
period PAS function is crucial, the airplane cannot be flown with the mechanical pitch 
axis control system alone. This makes airplane safety dependent upon an electric control 
system and suggests the change to a full FBW pitch axis to obtain the benefits of weight 
and cost reduction due to eliminating the mechanical pitch system. Figure 16 shows a 
block diagram of the FBW system defined in the study. Volume II, Appendix C, describes 
a pitch FBW servoactuator and its redundancy concept. 

The primary cable system is replaced by quadruple electric paths. Pilot inputs are 
converted into quadruple electric signals and routed to the Essential PAS Computers. 
These signals are processed to generate a pilot elevator command that is summed with the 
ACT signals: Full PAS (normal condition) or Essential PAS (Full PAS failure), and MLC 
elevator command. Quadruple redundancy provides sufficient reliability; no backup 
system for the FBW by either direct electric link or mechanical link is included because 
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Table 4. Comparison of Integrated, Segregated, and Selected Systems 
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Figure 16. Pitch Axis Fly-by-Wire System 


loss of the FBW loses the crucial short-period function that by itself would result in loss 
of the airplane. The FBW and the crucial short-period PAS share the computers and the 
actuation system. The conventional artificial feel computer that provides a fixed-stick 
force per g is replaced by a simple spring. By an appropriate gain schedule in the 
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computers, the spring system provides a fixed displacement per g. The stick pusher of the 
Selected System is replaced by a pitch system signal that commands nose-down elevator 
directly without moving the control column. The autopilot will be a series system as 
shown in Figure 16. 

Table 5 shows the decidedly favorable changes in Selected System cost and weight 
parameters resulting from substitution of pitch axis FBW for the conventional mechanical 
system. The lateral and directional control systems also have very complex mechanical 
assemblies and should be redesigned in FBW form to obtain maximum benefit from the 
concept. 


Table 5. Changes Due to Pitch Axis 
Fiy by Wire 


Purchase cost 

-$90 100 

System weight 

-157 kg 
(-345 lb) 

Fuel burn per flight hour 

-12 kg 
(-27 lb) 

Incremental return on 
investment 

-H3.0% 
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7.0 SELECTED SYSTEM GENERAL DESCRIPTION 


This section describes the Active Controls Technology (ACT) system concept resulting 
from the Current Technology ACT System Design Task. The concept, introduced in 
Subsection 6.4, was selected by conducting trade studies of system configurations, 
computer architecture, and actuation systems. 

Subsection 7.1 is a concise description of the overall ACT system. Subsection 7.2 is an 
overview of the flight control system of the ACT airplane and includes general 
descriptions of the primary flight control system, secondary flight control system, and 
automatic flight control system. Subsection 7.3 describes the general configuration and 
functional configuration of the Selected System. Finally, operation of the Selected 
System is presented in Subsection 7.4. 

7.1 SELECTED SYSTEM CONCEPT 

The Selected System normally implements all ACT control laws in a single triplex set of 
computers and provides a separate quadruplex set of computers for backup crucial 
function implementation. The ACT Primary Computers compute all control laws and 
drive all ACT servos except the elevator servos. The Essential Pitch-Augmented Stability 
(PAS) Computers compute a simple fixed-gain short-period PAS control law and drive the 
elevator servos. A single ACT Maintenance and Display Computer performs general 
system management, communication, and data storage functions. 

The sensor configuration is the same as in the Integrated System except for the addition 
of four dedicated pitch-rate sensors as in the Segregated System. A new actuator concept 
has been adopted for the flaperons, with electrically commanded power control units 
(PCD) force summed by the flaperon torque box structure. The angle-of-attack limiter 
(AAL) actuators have been modified to operate from low-pressure engine bleed air rather 
than the high-pressure nitrogen system used in previous configurations. Figure 17 
illustrates the Selected System configuration. 
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Figure 17. Selected System Configuration □ ^ct.ve control system equipment 


7.1.1 SELECTED SYSTEM COMPUTERS 

The ACT Primary Computers calculate control laws for Full PAS, AAL, 
lateral/directional-augmented stability (LAS), wing-load alleviation (WLA), and flutter- 
mode control (FMC) functions. Full PAS includes short-period PAS and speed PAS to give 
the airplane good longitudinal handling qualities. The ACT Primary Computers receive air 
data and inertial reference signals from the airplane triplex digital air data computers 
(DADC) and inertial reference systems (IRS) over Aeronautical Radio Incorporated 
(ARINC) 429 digital buses. Dedicated ACT sensors provide wing accelerations for FMC 
and gust-load alleviation (GLA) functions and column force for maneuver-load control 
(MLC). Other sensors include flap and slat position and servo position feedback. Dynamic 
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pressure and center-of-gravity acceleration are taken directly from sensors in the DADC 
and IRS and transmitted over analog lines, bypassing the computing portions of those two 
sensor systems. 

Each ACT Primary Computer is directly connected to only one sensor in each triplex set. 
Incoming sensor data are transmitted cross channel by an autonomous input/output (I/O) 
controller so all these computers see data from all sensors. The central processing unit 
(CPU) is not required in this cross-channel transmission; if a CPU fails, the other two 
computers still receive full sets of sensor data. 

Sensor signals are monitored for failures and processed to select a single value for each 
signal that is used in control law calculations. Computer outputs are monitored and all 
but elevator signals are sent to servoelectronics to drive ACT servos. The ACT Primary 
Computers monitor servo operation (except elevators) and shut down a servo if the servo 
or the computer driving it fails. Failure detection is primarily accomplished through 
cross-channel comparison augmented by inline monitoring. Because inline monitoring is 
not considered 100% accurate, single-channel operation is permitted only for the LAS 
function, which meets special safety requirements stated in Subsection 5.2.2. 

The Essential PAS Computers drive the elevator servos and calculate a simple fixed-gain 
short-period PAS control law capable of providing minimum acceptable longitudinal 
handling qualities. The Essential PAS Computers receive elevator commands from the 
ACT Primary Computers over ARINC 429 buses. Each of the three Essential PAS 
Computers receives data directly from an ACT Primary Computer, but after cross- 
channel communication all four Essential PAS Computers have data from all three ACT 
Primary Computers. CPU action is required for this transfer. In addition, each Essential 
PAS Computer receives signals from the four dedicated pitch-rate sensors. Each sensor is 
directly connected to all four computers. In normal operation, an Essential PAS 
Computer selects the midvalue of the ACT Primary Computer elevator commands (or 
average value after one failure) and uses that to drive an elevator servo. If the PAS 
signal from the ACT Primary Computers fails, the Essential PAS Computers substitute 
their own short-period PAS command, calculated using the signals from the dedicated 
pitch-rate sensors. 


81 



The ACT Maintenance and Display Computer coordinates testing of the system and 
collects fault data from the ACT Primary and Essential PAS Computers. These data are 
stored to be used later by maintenance personnel; advisories and warnings are displayed to 
the flight crew as required. 

7.1.2 SELECTED SYSTEM ACTUATORS 

The Selected System uses four different types of actuators; these actuators are described 
in the following paragraphs. 

Secondary Force-Summed Actuator (With Mechanical Primary Control System)— The sec- 
ondary force-summed actuator scheme is used for elevators, rudders, and the outer 
segment of the outboard ailerons where the ACT functions share the control surfaces with 
pilot and autopilot inputs. The output of the ACT secondary actuator is series summed 
with the pilot or autopilot mechanical input to form the total surface command. Detailed 
description of the secondary actuator is contained in Subsection 8.1.3. Figure 1 1 is a 
simplified diagram illustrating the concept. The secondary actuation concept is used for 
control of the rudder (LAS), outer section of outboard aileron (WLA), and elevator (PAS 
and MLC). Outputs from the ACT Primary Computers control the secondary actuator of 
the rudder and the outboard aileron outer section directly. 

ACT Dedicated Force-Summed Actuator— This fly-by-wire force-summed actuation 

scheme was developed to meet the requirements of the flaperons, which are commanded 
by WLA signals from the ACT Primary Computers. The WLA function requires two 
actuators plus a mathematical model to meet the fail-operational requirement. Normally 
two hydraulic systems are required to implement dual actuation systems. A major 
concern of this approach is that a separated flap would cause the simultaneous loss of 
both hydraulic systems. Because of this, only one hydraulic power system is directly 
connected to the flaperon actuator. A hydraulic motor-pump unit is used to connect the 
second hydraulic power system as backup to the normal power supply system for power 
redundancy. Figure 18 illustrates this scheme. Subsection 8.1.3 describes this actuation 
system in more detail. 

ACT Dedicated Force-Displacement Summed Actuator— The third actuation scheme, the 
dedicated force-displacement summed actuator, is shown in Figure 12. It is used to 
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Hydraulic 
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Figure 18. Flaperon Hydraulic Actuation System 


control the inner section of the outboard aileron, which is shared by the pilot, autopilot, 
and ACT functions (FMC and WLA). It was designed to remain fully operational after one 
electric failure and one hydraulic failure. The pilot input is converted into electric 
signals by position transducers and summed with the FMC and WLA commands in the ACT 
Primary Computers. The autopilot controls the inner section of the outboard aileron by 
parallel actuators that move the cables and back drive the control wheels. 
Subsection 8.1.3 describes this in more detail. 
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Dual Pneumatic Actuator— The fourth actuator scheme, the dual pneumatic actuator, is 
used as the stick pusher, which provides positive stall prevention by strong, rapid forward 
motion of the control column at the incipient stall point. Figure 13 is a simplified 
diagram of the concept. This concept was developed to replace the high-pressure 
pneumatic stick pusher actuator defined for the Integrated System, which used high- 
pressure bottled gas, causing special problems in system test, maintenance, and servicing. 
The new scheme uses low-pressure air from the engine bleed system instead of nitrogen 
from a high-pressure bottle that must be frequently checked and refilled. 
Subsection 8.1.3 describes the dual pneumatic actuator in detail. 

7.1.3 ESSENTIAL PAS SYSTEM 

The Essential PAS System is a highly reliable system that provides minimum acceptable 
handling quality in pitch axis control. A simple fixed-gain pitch-rate feedback is 
implemented in quadruple redundancy to meet the fail-operational/fail-operational 
requirement. Figure 17 illustrates this system. Each of the dedicated analog pitch-rate 
sensors is connected to each of the quadruple computers; i.e., cross-strapped channel 
communication is used. The analog pitch-rate signals are processed in each computer by 
the signal selection and failure detection (SSFD) algorithm to produce a single value for 
computation of the fixed-gain short-period PAS control law. Normally, the output of the 
Essential PAS Computers is not coupled to the elevator actuators. The elevator 
commands from the ACT Primary Computers normally control the pitch axis. These 
elevator signals are sent to the Essential PAS Computers, which continuously monitor 
their uniformity. When the primary short-period PAS has failed, the fixed-gain pitch-rate 
feedback takes over the pitch axis control. 

The computers of the Essential PAS System are operated asynchronously as in the case of 
the Segregated System. Feasibility of fixed-gain PAS has been verified in the laboratory. 
Outputs of the Essential PAS Computers command the elevator through the secondary 
force-summed actuators. The triple force-summed actuators plus mathematical models 
implemented in the computers meet ihe fail-operational/fail-operational requirement. 
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7.2 FLIGHT CONTROL SYSTEM OVERVIEW 


The flight control system is divided into primary, secondary, and automatic flight control 
systems based upon function. The primary control system provides the basic capability of 
maneuvering, stabilizing, and trimming the airplane. The secondary control system 
manipulates wing trailing-edge flaps, leading -edge slats, and spoilers to control airplane 
lift and drag. The automatic flight control system provides the autopilot, flight director, 
and thrust management to reduce pilot's workload. 

The general arrangement of the flight control surfaces of the current technology ACT 
airplane is shown in Figure 19. 

7.2.1 PRIMARY FLIGHT CONTROLS 

The primary flight controls control the airplane in the longitudinal (pitch) axis, lateral 
(roll) axis, and directional (yaw) axis. The following subsections describe controls for 
these three axes and the primary flight control electronics. 

7.2. 1.1 Longitudinal Controls 

Longitudinal controls consist of elevator control and horizontal stabilizer trim. The 
elevator controls illustrated in Figures 20 and 21 position two single-segment dual-hinge 
elevators in accordance with pilot, ACT, and AFCS inputs. Each elevator is powered by 
three side-by-side PCUs. The pilots position the elevator (via PCU) by control columns 
and cables. The pilots' control columns are interconnected by a torque shaft incorporating 
a jam override spring and a manual disconnect mechanism. The control column is also 
controlled by an AAL to prevent the airplane from exceeding a limiting angle of attack. 
The electric elevator commands from the Essential PAS Computers are converted into 
mechanical signals through the ACT secondary elevator actuators and then summed in 
series with the pilots' mechanical input. To meet the redundancy requirement of crucial 
short-period PAS, quadruple sensors and computers are provided in the Essential PAS 
System. Three side-by-side force-summed secondary actuators are used for ACT elevator 
control. In addition to the triple ACT elevator actuators, mathematical actuator models 
are programmed in the backup computers to meet the fail-operational/fail-operational 
requirement of short-period PAS. The ACT Primary Computers process the control laws, 
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Figure 19. Aerodynamic Control Surfaces 
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Figure 21. Longitudinal Control System 






redundancy management, and testing function of PAS and MLC and send the 
elevator command to the Essential PAS Computers. Triple sensors and computers are 
provided in the ACT Primary System to meet the fail-operational requirement. 

The autopilot elevator signals are converted into mechanical signals by the parallel 
autopilot secondary actuators to control the elevators. To meet the category III-B 
automatic landing requirement, triple electronics and force-summed secondary actuators 
are provided. 

The elevator control cable systems are connected to a common artificial feel mechanism 
that is modulated by variable hydraulic pressure controlled by dual pressure modules. 

The horizontal stabilizer trim control is illustrated in Figure 22. The stabilizer trim 
actuator consists of a ballscrew and nut, upper and lower gimbals, primary no-back brake, 
reduction gearing, and two hydraulic motors that drive the reduction gearing via a 
differential gear assembly. Each motor is also connected to a hydraulic pressure-released 
brake, controlled by a separate control module, and powered by a separate hydraulic 
system. Each control module contains two valves: one to arm the module by turning on 
hydraulic power, and one to control flow to one motor. The arm and control valves are 
commanded either electrically or mechanically. The electric commands are controlled by 
dual trim interface units. Manual electric trim commands originate at two dual switches, 
one on each pilot's control wheel. The trim interface units prohibit electric trim 
commands in opposition to elevator control inputs. Manual mechanical trim commands 
are transmitted to the control modules by dual control cables connected to dual levers on 
the pilots' aisle stand. All electric commands may be overridden by mechanical 
commands. Each control module contains a stabilizer rate-limiting valve that reduces 
hydraulic fluid flow as a function of airspeed. Dual electric stabilizer position indicators 
are mounted on the aisle stand and connected to dual stabilizer position sensors. 

7. 2. 1.2 Lateral Controls 

Lateral controls position the inboard aileron, outboard aileron, inboard flaperon, outboard 
flaperon, and five spoiler panels on each wing as shown in Figures 23 and 24. The 
outboard aileron is split into two sections. The pilot and autopilot use the ailerons and 
spoilers to maneuver the airplane in the lateral axis. The FMC of the ACT uses only the 
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Figure 24. Aileron Control System 



































small inner section of the outboard aileron to enable high-frequency response. The WLA 
of the ACT uses the outboard aileron (including both inner and outer sections), inboard 
flaperon, and outboard flaperon to control the wing loads induced by pilot maneuver and 
atmospheric turbulence. 

The pilots' input for lateral control is provided by two control wheels. The output of the 
control wheels, through a dual cable system, positions the ailerons except for the inner 
section of the outboard aileron. The pilots control the inner section of the outboard 
aileron electrically through the triple ACT Primary Computers. The actuators of the 
outboard aileron outer section receive their input command via cables from the inboard 
aileron motion. The control inputs of the outboard aileron (including both sections) from 
both pilot and autopilot are locked at neutral at high airspeed and unlocked at low speed. 
However, the inner sections of the outboard aileron are controllable by the ACT Primary 
Computers at cruise speed for FMC and WLA control. The control cables are connected 
to a dual feel and centering mechanism at each forward quadrant. 

The electric command for the outer section of the outboard aileron is computed in the 
triple ACT Primary Computers and converted into a mechanical signal through the ACT 
secondary actuators and then summed with the pilot and autopilot in series. Dual side-by- 
side force-summed secondary actuators and the mathematical models implemented in the 
triple ACT Primary Computers provide a fail-operational capability for WLA. The 
electric command signal for the inner section of the outboard aileron is generated in the 
triple ACT Primary Computers by summing the FMC, WLA, and pilot inputs. To meet the 
fail-operational requirement of FMC and WLA, dual side-by-side force-summed dedicated 
PCUs plus mathematical models are provided for control of the inner section of the 
outboard aileron. 

In the system selected in the Current Technology ACT System Definition Task, GLA is 
assumed to use the outboard flaperon and MLC is assumed to use the inboard flaperon. 
Dual force-summed actuators plus mathematical models are used to. meet the fail- 
operational requirement. The flaperon actuator receives hydraulic power through swivel 
joints. To avoid the simultaneous loss of two hydraulic systems in the flaperon actuation 
system, only one hydraulic system is directly connected to the dual actuators. 
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The spoilers are controlled electrically through the control system electronic unit (CSEU). 
Flight spoilers may be used as speed brakes while continuing to provide lateral control. 

The lateral autopilot manipulates the outboard and inboard ailerons and spoilers to control 
the airplane during roll. To meet the category Ill-B automatic landing requirement, triple 
redundancy is provided in sensors, computers, and actuators. Parallel force-summed 
actuators are used to drive the ailerons and to back drive the control wheels. 

Lateral trim is accomplished using electric switches located on the aisle stand to control 
an electronically operated actuator that connects to the trim feel and centering 
mechanism at the forward quadrant bus and changes the neutral position of the lateral 
control system. 

7. 2. 1.3 Directional Controls 

Directional controls position the two double-hinged rudder surfaces as shown in Figures 25 
and 26. Each rudder is controlled by dual PCUs. The actuators are signaled by the pilots' 
rudder pedals through a common cable system coupled by separate pushrods and linkages 
to PCUs in the vertical tail. The LAS of the ACT system performs yaw damper and turn 
coordination originally computed in the CSEU of the Baseline system. The electric LAS 
commands generated in the triple ACT Primary Computers are converted into mechanical 
signals through the secondary actuators and then summed in series with the pilots' 
mechanical input. Dual side-by-side force-summed actuators plus mathematical actuator 
models implemented in the ACT Primary Computers provide fail-operational capability in 
the LAS function. Lateral control includes rollout guidance, which is a part of category 
III-B automatic landing. Triple rollout guidance actuators are provided to meet the fail- 
operational requirement. 

Separate rudder ratio changers are installed in the upper and lower rudder control 
linkages. A fixed-gradient, artificial feel mechanism is connected in parallel to the 
control cable system common to the upper and lower rudders. The neutral position of the 
feel mechanism is varied by an electric trim actuator. 
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Figure 25. Rudder Actuator Installation 
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7^. 1.4 Primary Flight Control Electronics 


The primary flight control electronics include ACT electronics and the CSEU. The ACT 
electronic system is described in Subsections 7.3 and 8.0. Only the CSEU function is 
described in this subsection. The CSEU function is shown in Figure 27 and includes rudder 
ratio changer, spoiler control, stabilizer trim interface, and outboard aileron lockout. 
These functions are described in the following paragraphs. 


Rudder Ratio Chamger— The rudder ratio changer provides a variable schedule of rudder 
deflection versus rudder pedal input as a function of dynamic pressure. The ratio changer 
electronics are online replaceable cards in the CSEU. 

Input Servos 



Figure 27. Control System Electronic Unit 
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Spoiler Control-Spoiler control causes the spoiler panels to deploy as a function of control 
wheel deflection, speed lever position, and air-to-ground logic. The 10 spoiler panels are 
programmed in symmetric pairs to provide speed brakes, ground spoilers, and, in 
conjunction with ailerons, linearization of rolling moment to wheel deflection. Spoiler 
control includes control modules installed in the CSEU. Each control module commands a 
symmetrical pair of spoiler panels. One electrohydraulic power control actuator drives 
each spoiler panel. 

Stabilizer Trim-The stabilizer trim function will maintain the airplane in a trimmed 
condition per various alternative sources of trim command signals. Two independent 
actuation systems position the stabilizer in response to the source commands. An electric 
module in the CSEU selects a particular trim signal source and also energizes one or the 
other actuation system. The three sources of electric trim command are the flight 
control computers (FCC), the pilot electric trim switches, and the ACT Primary 
Computers. Selection of the active trim source is accomplished by logic circuits in the 
CSEU. 

Outboard Aileron Lockout— Outboard aileron lockout logic provides discrete signals to the 
left and right outboard aileron lockout actuators and to lockout logic in the ACT Primary 
Computers. The lockout actuators disable the pilot inputs to the outer section of the 
outboard aileron. The lockout logic in the ACT Primary Computers will disconnect the 
pilot input to the inner section of the outboard aileron by software. 

7.2.2 SECONDARY FLIGHT CONTROLS 

Secondary flight (high lift) controls position the wing trailing-edge flaps and the wing 
leading-edge slats in a coordinated manner. The trailing-edge flaps and the leading-edge 
slats are controlled to three positions (cruise, takeoff, and landing). The wing spoiler 
panels are controlled symmetrically as a secondary flight control function for in-flight 
drag modulation and landing deceleration. 

Wing Trailing-Edge Flap Controls— The wing trailing-edge flap surfaces (see fig. 28) are 
driven by two centrally located power drive units, one driving the inboard trailing-edge 
flaps and the other driving the outboard trailing-edge flaps. Each power drive unit is 
powered by a hydraulic motor with alternate electric motor operation. The drive units 
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Figure 28. Leading- and Traiiing-Edge High-Lift System 
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are connected to torque-tube systems in each wing to drive mechanical rotary actuators 
on each inboard and outboard flap segment. A torque-limiting brake is provided in each 
rotary actuator, which also incorporates a no-back brake. Asymmetry detection systems 
shut off the respective power drive units if the inboard or outboard flaps become 
asymmetric between left and right wings or between actuators on a flap segment. Flap 
position indication is provided to the flight deck indicator from each flap panel. 

Wing Leading-Edge Slat Controls— The wing leading-edge slat controls shown in Figure 28 
use two power drive units located in the inboard wing leading edges, one to drive the 
inboard leading-edge slats and the other to drive the outboard leading-edge slats. 

The controls are programmed to extend partially the leading-edge slats before trailing- 
edge flap extension and to retract the slats after trailing-edge flap retraction. Each 
power drive unit is powered by a hydraulic motor with an electric motor alternate. The 
drive units are normally controlled by a dual cable system from the flight deck control 
lever. If hydraulic power is lost, the electric alternate system can be controlled by flight 
deck switches. The drive units are connected to torque-tube systems that run along the 
front spar of each wing and drive the screw jacks mounted on each slat segment. Each 
screw jack on each slat segment incorporates a no-back brake and a torque-limiting brake. 
Indication is provided to the flight deck when the leading-edge slats are in transit or fully 
extended. Failure of any slat surface to fully extend or fully retract is indicated by the 
intransit lights. 

7.2.3 AUTOMATIC FLIGHT CONTROLS 

The automatic flight control system (AFCS) provides the following functions: autopilot, 
automatic stabilizer trim, flight director, and thrust management. These functions will 
reduce the pilots' workload in flight by automatically controlling the flight path and 
engine thrust or by providing flight guidance signals to pilots. 

Figure 29 and Table 6 show subsystem partitioning and summary definition of the major 
components of the AFCS. 

Automatic flight controls are shown in Figures 30 and 31 and provide the following major 
functions: autopilot, flight director, and thrust management. These functions are 

described in the following subsections. 
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Figure 29. Automatic Flight Control (Functional Partitioning) 


7. 2 .3.1 Autopilot 

The autopilot function is computed in the FCC. Three FCCs are provided for those 
autopilot modes that require redundancy. The following autopilot modes are provided. 

Control Wheel Steering Mode— Control wheel steering (CWS) is a selectable mode of 
operation for the autopilot. It provides (1) pitch and roll maneuver control for pilot inputs 
and (2) pitch attitude hold and roll or heading hold when there are no pilot inputs. 
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Table 6. Major Components of Automatic Flight Controls 


Description 

Quantity 

Autopilot controls 


Flight control computer 

3 

Integrated autopilot/flight director 
autothrottle/mode control panel 

1 

Maintenance control and display panel 

1 

Remote-mounted maintenance panel 

1 

Thrust management 


Thrust management computer 

1 

Rating limit select panel 

1 

Limit display and mode annunciation 
panel 

1 

Miscellaneous flight control electronics 


Autopilot interface unit 

3 

Flight mode annunciator 

2 

Barometric altitude rate unit 

1 

Sensor flag warning annunciator 

1 


Altitude Select Mode— Altitude select is the basic pitch mode and is armed when the 
autopilot is placed in the command mode and a glide slope has not been captured. 

Vertical Speed Select and Hold Mode— Vertical speed select and hold is the basic pitch 
transition mode between selected altitudes. It is engaged synchronously when the 
autopilot is initially engaged into the command mode of operation or when the vertical 
speed mode is selected. 

Vertical Profile Mode— Vertical profile mode is a selectable altitude transition mode that 
uses combined autothrottle and elevator control. This mode provides airspeed and Mach 
control through the elevators during altitude transitions coupled with either selected 
rated (or derated) (low-pressure compressor speed) control during climb or idle thrust 
during descent. When maintaining altitude, airspeed and Mach control is automatically 
transferred to the autothrottle control section. Two selectable submodes of the vertical 
profile mode are available. One submode is the automatic mode in which target altitudes 
and speeds are automatically commanded by the flight management computer. The other 
submode is manual in which the target altitudes and speeds are manually entered through 
the mode control panel. 
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Figure 30. Automatic Flight Controls (Autopilot/Flight Director) 


Heading Select Mode-Heading select is the basic lateral mode and is engaged 
synchronously when the autopilot is initially engaged into the command mode of 
operation. Heading preselect capability is available whenever the mode is selected from 
any other engaged lateral command mode. 
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Figure 31. Automatic Flight Controls (Thrust Management) 


Navigation Mode— Navigation is a selectable lateral mode that uses the flight management 
computer to provide lateral steering commands to the autopilot function in the FCC. The 
flight management computer commands can be based on very-high-frequency omni- 
directional radio range (VOR) information or waypoint guidance. 
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Localizer Mode— This selectable lateral mode allows the lateral autopilot function to be 
coupled to a localizer independent of the glide slope. 

Approach Mode— The approach mode is a selectable mode that provides automatic glide 
slope and localizer control and manually initiated automatic go-around control. This 
mode can be operated multichannel through touchdown and automatic rollout. The mode 
meets the fail-operational requirement with triple redundancy and meets fail-safe with 
dual redundancy. 

VOR Mode— The VOR mode is optional if the flight management computer is deleted. In 
this configuration, the navigation (NAV) mode of autopilot operation couples the VOR 
receiver outputs into the FCC to provide VOR control. This mode is not part of the basic 
certification of the airplane. 

7.2.3.2 Flight Director 

The flight director function is also computed in the FCC and has the same modes as the 
autopilot functions plus one additional mode, localizer back beam. The flight director 
command displays can be turned on and off, independent of whether or not an autopilot 
function is selected. Provisions are included to allow the flight director command bars to 
be automatically biased out of view whenever the autopilot function is engaged in modes 
other than CWS. 

The control mode select functions for autopilot, flight director, and autothrottle are 
integrated into a single panel. Select knobs are provided for indicated airspeed and Mach, 
altitude, vertical speed, heading, and course. 

7.2.3.3 Thrust Management 

The thrust management system includes the thrust rating limit and autothrottle functions. 
These computations are performed in the thrust management computers located in the 
electronic equipment bay. Space provisions are made for a second thrust management 
computer. The thrust rating limit and autothrottle functions are described in the 
following paragraphs. 
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Thrust Rating Limit— The thrust management computer selects, computes, and displays 
engine-rated thrust limits. Figure 31 is a simplified diagram illustrating the thrust 
rating limit. Controls for selecting thrust rating limits and commanding derated limits 
are provided on the thrust limit selection panel located near the engine instruments; the 
limits are displayed on the limit display and mode annunciation panel shown in Figure 31. 
Selection limits include takeoff and go-around, climb, maximum continuous, and cruise. 
Actuation of automatic go-around switches at the thrust levers automatically causes go- 
around thrust limit to be selected and displayed. Unlocking the thrust reverse 
automatically causes reverse limit to be selected and displayed. The thrust management 
computer interfaces with the engine instruments to position an indicator to show the 
value of the selected thrust limits or derated limit. 

Autothrottle— The thrust management computer controls the thrust levers, via the 
autothrottle servomotor, to provide full-range thrust control (within the thrust rating 
limits) during climb, cruise, approach, and landing. 
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7.3 SELECTED SYSTEM CONFIGURATION 


Subsections 6A and 7.1 introduced the general configuration of the Selected System. This 
subsection presents the same configuration in more detail. Subsystem functions and 
components of the Selected System are described in Section 8.0. 

The system consists of the ACT Primary System, Essential PAS System, and ACT 
Maintenance and Display Computer as shown in Figure 17. The ACT Primary System 
implements five ACT functions— Full PAS, AAL, LAS, WLA, and FMC— and provides all 
active controls in the normal system condition. Essential PAS implements a simple short- 
period PAS control law and is engaged when the short-period PAS of the Full PAS has 
failed. These functions are described in the following subsections. 

7.3.1 ESSENTIAL PAS SYSTEM 

The Essential PAS System implements a highly reliable, fixed-gain short-period PAS that 
provides minimum acceptable handling quality in the pitch axis. Figure 32 shows a 
simplified block diagram of the Essential PAS System. To meet the reliability require- 
ment, the system provides quadruple pitch-rate sensors, quadruple computers, and triple 
actuators, plus actuator mathematical models. The pitch-rate sensors are simple analog 
devices dedicated to the Essential PAS System. Each of the quadruple analog pitch-rate 
sensors is directly connected to all of the computers. The consolidated pitch-rate signals 
are processed by the SSFD algorithm to create a signal for control law computation and to 
monitor system failure status. The output of the Essential PAS control law is normally 
disconnected from the servocommand summing circuits. Full PAS failure status is 
monitored as shown in Figure 32. When the short-period PAS of the ACT Primary System 
fails, the fixed-gain short-period PAS is introduced into the loop using easy-on logic. The 
PAS and MLC elevator commands of the ACT Primary System are processed by the SSFD 
algorithm to form a summed elevator command and to monitor their failure status. To 
provide functional independence, elevator commands of short-period PAS, speed PAS, and 
MLC are processed separately by the SSFD algorithm. Outputs of the triple ACT Primary 
Computers are connected to Essential PAS Computers A, B, and C, where the signals are 
routed to other channels via digital cross-channel communication links. The computers 
are operated asynchronously; this feature of Essential PAS has been verified in laboratory 
testing. Three of the quadruple computers command the triple forced-summed elevator 
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Figure 32. Pitch-Augmented Stability Block Diagram 































actuators. Figure 11 shows the side-by-side force-summed secondary actuation concept 
used for the elevator control. Output of the secondary ACT actuator is series summed 
with the autopilot's or the pilot's mechanical control signal to form a command input to 
the elevator PCU. Each channel contains a conventional two-stage electrohydraulic 
servovalve that converts the input electric signal into hydraulic flow. The hydraulic flow 
displaces the actuator piston against the center spring. Valve spool and ram positions are 
fed back to each computer for servo-loop control and failure detection. A force detent is 
provided to serve as an antijam device. 

7.3.2 ACT PRIMARY SYSTEM 

The ACT Primary System implements five ACT functions in triple redundancy. The 
following paragraphs describe each function. 

Full PAS— Full PAS includes both short-period and speed PAS to provide good handling 
quality in the pitch axis equivalent to or better than in a conventional airplane. Figure 33 
shows a block diagram of Full PAS. Short-period PAS uses pitch-rate signals from the 
triple IRS sensors and control column signals to generate an elevator command. The 
pitch-rate and column signals are sent to the dedicated primary computers where the 
signals are routed to other primary computers via cross-channel communication. The 
feedforward and feedback gains of the short-period PAS are scheduled as a function of 
airspeed. In case of airspeed sensor (DADC) failures, the gain schedule becomes 
dependent upon flap position signals. If the IRS signals are lost, pitch axis control 
deteriorates to a minimum acceptable level. However, the pilot will be able to control 
the airplane with the combination of the remaining speed PAS and the Essential PAS 
System. The primary computer must forward status information on its short-period PAS 
to the essential computer to enable timely engagement of the Essential PAS control law. 

The output of the elevator actuators is used to relieve a steady-state elevator trim 
deflection. When the elevator deflection exceeds a certain threshold value for more than 
a predetermined time, the elevator offload logic acts to adjust pitch trim by moving the 
horizontal stabilizer through the stabilizer trim interface in the CSEU. The CSEU trim 
function receives the autopilot, pilot, and ACT trim inputs and selects an appropriate 
signal to command the stabilizer position. Figure 34 shows a simplified block diagram of 
the elevator offload function. 
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Figure 33. Full Pitch-Augmented Stability Block Diagram 
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Figure 34. ACT Elevator Actuator Off load Function 


Angle-of-Attack Limiter (AAL)— The AAL function includes the stick shaker and the stick 
pusher. Figure 33 is a block diagram of the AAL subsystem. Maximum allowable angle of 
attack, the AAL reference point, is defined as a function of leading-edge slat and trailing- 
edge flap position and airspeed. When the difference between the actual angle of attack 
and the reference angle declines below a certain threshold, the stick shaker is activated 
to provide stall warning. Pitch-rate signals shown in Figure 33 provide anticipation; i.e., 
if the airplane rapidly approaches the stall condition, the stick shaker will be activated 
sooner by the pitch-rate signal. If no pilot action results from the stick shaker warning, 
the stick pusher operates to apply an airplane nose-down force on the control column. 
Figure 36 shows the AAL actuation system of the Selected System. The actuator uses 
low-pressure air from the basic airplane engine bleed system and pressure from an 
accumulator as dual power supplies to meet the fail-operational requirement. Actuation 
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Figure 35. Angle-of-Attack Limiter Block Diagram 


time of the stick pusher actuator is approximately 0.2 sec. The pilot may override the 
pusher at any time by exerting sufficient force on the column or by operating a manual 
dump that directly vents the actuator to ambient. 

Lateral/Directional-Augmented Stability (LAS)— The LAS function, which includes the 
conventional yaw damper and turn coordination originally implemented in the Baseline 
CSEU and automatic flight control computer, is implemented here in the triple ACT 
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Primary System. Figure 37 is a block diagram of the LAS function. The yaw rate and 
bank angle from the triple IRSs and control wheel signals are used to improve dutch roll 
damping and reduce side-slip angle. Air data signals from the triple DADCs are used as 
gain schedule inputs to provide good handling quality equivalent to or better than that of a 
conventional airplane. In case of DADC loss, LAS will use flap position as a backup gain 
schedule input. The ground rule of Subsection 5,1 states that single-thread operation is 
permitted if the function meets the following three conditions: 



Legend: 

FD failure detection 
SS signal selection 

Figure 37. Lateral /Directional-Augmented Stability Block Diagram 
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Adequate self-monitor can be provided. 


• Pilot is able to detect system failure by observing airplane performance or other 
cues. 

• Authority and rate limit can be provided in the actuators to prevent hardover or 
oscillatory failures causing structural damage. 

LAS can meet these three conditions. Thus the airplane can dispatch with restriction 
when a single channel (one success path) is available in the LAS system. 

Two of the triple ACT Primary Computers command the rudder control surfaces through 
secondary force-summed actuators similar to the elevator actuator. Mathematical 
actuator models are implemented in the triple computers to meet the fail-operational 
requirement. 

Wing-Load Alleviation (WLA)— The WLA function, which has the most complex I/O 
interfaces because of the large number of airplane control surfaces used, is implemented 
in the triple ACT Primary Computers. The function consists of maneuver-load control 
(MLC) and gust-load alleviation (GLA) subfunctions. By moving the outboard aileron, 
MLC controls wing loads induced by pilot maneuver and reduces low-frequency gust loads. 
To compensate for the pitching moment caused by symmetric aileron motion, an elevator 
command is sent to the Essential PAS Computer, where the total ACT elevator command 
is formed by summing command inputs from these functions. In addition to the elevator 
and aileron, the WLA function uses inboard and outboard flaperons. 

Figure 38 is a block diagram of WLA showing its sensors and control surfaces. The 
function uses center-of-gravity and wing acceleration signals as inputs to control law 
computation. Air data signals from the triple DADCs are used to gain schedule the 
control laws. WLA shares the inner segment of the outboard aileron with FMC and 
manual pilot control. The control wheel input is converted into triple electric signals that 
are routed to the ACT Primary Computers. Command signals from WLA, FMC, and the 
pilot are there summed by software before being sent to the inner segment of the 
outboard aileron. 
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Figure 38. Wing-Load Alleviation Block Diagram 


A force-displacement summed actuation concept is used in the outboard aileron inner 
segment actuator. Figure 12 is a simplified block diagram of this actuation concept. The 
command signals from each of three ACT Primary Computers are magnetically flux 
summed in the four first-stage electrohydraulic servovalves, two per hydraulic system. 
Output of the valves is mechanically position summed by a linkage to control the power 
valve. The dual pistons are force summed to control the inner section of the outboard 
aileron. 
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WLA also uses the trailing-edge flaperons as control surfaces. Two hydraulic systems are 
required to meet the fail-operational requirement of the WLA function. Hydraulic power 
must be supplied to the flaperons through swivel joints. The plan for ensuring hydraulic 
system safety in the event of swivel joint failure or flap separation is described in 
Subsection 7.1 and illustrated in Figure 18. 

Flutter-Mode Control (FMC)— The FMC function suppresses flutter modes at airspeed 
between and l*2Vj^ by sensing wing acceleration and driving the inner segment of the 
outboard aileron. Figure 39 is a block diagram of the FMC function. Triple 
accelerometer outputs from right and left wings are processed by the SSFD algorithm to 
generate a signal for control law computation and sensor monitoring. 



Right and left 
outboard aileron 
(inner) actuators 


Figure 39. Flutter-Mode Control Block Diagram 
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7.3.3 ACT MAINTENANCE AND DISPLAY COMPUTER 


Use of two separate sets of control computers presents a need for coordination of their 
communication functions in a separate unit. These functions are: 

• Start test 

• Enunciate significant failures 

• Select appropriate operations advisory messages 

• Retain fault information for maintenance use 

The ACT Maintenance and Display Computer meets these needs. Its primary functions of 
output to the crew are shown in Figure 40. 
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Figure 40. ACT Displays 
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In its normal mode of operation, the ACT Maintenance and Display Computer accepts 
fault information from the ACT Primary Computers and the Essential PAS Computers. 
This information is processed in the ACT Maintenance and Display Computer micro- 
processor to determine status of both functions and the resulting advisory message if any 
is required. By using this processing and the caution and warning system of the Baseline 
Airplane, the crew is presented with essential fault information and the resulting 
operation change requirements. Thus, when the ACT Maintenance and Display Computer 
is active, the pilots do not need to refer to an operations manual for response to ACT 
system failure. 

A more detailed picture of the functions of this unit is contained in Figure 86. 
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7.4 ACT SYSTEM OPERATION CONCEPT 


In normal operation, the ACT system is entirely automatic and transparent to the flight 
crew and requires no crew attention. It also affects safety of flight, and hence the crew 
must be kept apprised of its condition. These facts lead to the system operation concept 
that follows. 

The crew communication functions are held to the minimum in both directions, crew to 
system and system to crew. The controls provided are only those needed for the crew to 
choose the time for preflight testing and for emergency manual disconnect. The displays 
provided are only those needed to communicate essential failure information and to (1) 
enable the crew to make appropriate dispatch and flight plan adjustment decisions under 
failure conditions and (2) supply data for maintenance essential to dispatch. These 
provisions are described in Subsection 8.4.3. 

With this system operating unattended by the crew, self-testing and self-monitoring 
become essential for tracking soundness of the system. The extensive digital computation 
capacity shown in Figure 17 makes that testing and monitoring practical. As stated in 
Subsection 5.3.1, one ACT function is crucial and all others are critical. All must be 
operating for dispatch without any flight restriction, and lack of any one of five of the 
ACT functions will prevent dispatch. Therefore, preflight test must be performed to 
verify that the airplane, from the ACT system point of view, is dispatchable. Similarly, 
in-flight monitoring must be done to keep track of ACT control system soundness and 
enable retreat to safe operating conditions if failures make that necessary. Finally, the 
effectiveness of ACT system maintenance operations must be rapidly verifiable; e.g., 
when a "no go" ACT airplane undergoes maintenance action at the flight line, such action 
must be quickly verified to restore dispatch status as early as possible. 

The preceding paragraphs refer to communication from the ACT system to the air crew in 
the event of some fault in the system. Figure 41 is a block diagram illustrating the 
system response to such faults; it shows a two-part parallel communication process that is 
effective during flight and preflight test. In the first part, the ACT Primary and/or 
Essential PAS Computers detect a line replaceable unit (LRU) fault, determine the 
corresponding ACT function status, and report that status to a dedicated ACT display. 
Then, from that information, possible prior faults, and current operating conditions, the 
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System: 



(Optional step) 


Figure 4 1. Response to ACT System Failures 


ACT Maintenance and Display Computer determines the operations advisory message (if 
any is needed) for transmission to the crew. Thus, the pilot can make his dispatch or 
flight plan change decision in either of two ways: 

• Observe the ACT status display and refer to an operations manual, the "manual 
option" shown at 1 in Figure 41 

• Observe the operations advisory, the "automatic option" shown at 2 in the figure 
Subsection 8.4.4 treats the fault response processes in greater detail. 
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8.0 SELECTED SYSTEM DETAILED DESCRIPTION 


This section describes, in detail, the system selected from studies described in 
Section 6.0. The description covers physical components such as sensors, computers, and 
actuators and also the design concepts involved in software, redundancy management, and 
system operation. 

Subsection 8.1 describes those sensors, computers, and actuators that are a part of the 
Active Controls Technology (ACT) system. It discusses the way the components of the 
Baseline are changed in form or use to accommodate the ACT functions. Subsection 8.2 
describes redundancy management and failure protection aspects of the ACT system. 
Subsection 8.3 is concerned with the software used to control the computers and with the 
memory requirements. Subsection 8.4 discusses system operation, test and maintenance, 
communications to and from the crew, monitors, and fault response. Subsection 8.5 
describes how the hydraulic system is changed from the Baseline Airplane to 
accommodate the needs of the ACT system. Subsection 8.6 describes changes to the 
electric system. 


8.1 SYSTEM COMPONENTS 


8.1.1 SENSORS 

The Selected System shares sensors with the automatic flight control system (ARCS) and 
display functions where appropriate. The Baseline Airplane provides many of the sensors 
required for the ACT functions; some special sensors must be added to meet ACT system 
standards of performance and redundancy. Figure 10 shows general locations of the ACT 
sensors. Table 7 lists all required sensors and associates them with the ACT functions 
that they serve. Table 8 is a condensed table of sensor specifications. 

The crucial short-period pitch-augmented stability (PAS) function must have quadruple 
redundancy to meet the reliability requirement. The Baseline Airplane senses the pitch 
rate in triplex by using the inertial reference systems (IRS). Addition of a fourth IRS is 
not economical. Furthermore, the Baseline IRS has a high failure rate (as shown in 
subsec 9.2.1), which is a severe drawback in a sensor for the crucial PAS control law. It is 
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Table 7. Sensors for ACT Systems 



124 


"Table" refers to Table 8 inertial reference system LVDT linear variable differential transformer 

Sensors added for ACT DADC digital air data computer VYRO pitch-rate sensor (trade name) 
































Table 8. Sensor Specifications 
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♦Sensors added for ACT 
♦Typical of several; used in various 
functions 


















essential to have a small and reliable source of pitch-rate signal for the ACT system. The 
VYRO, a small, long-life, vibrating beam sensor designed by General Electric, is one of 
the acceptable sensors that can supply the quadruple pitch-rate signal. 

The airspeed variables shown in Table 7 are needed for gain variation schedules in several 
control loops. The table also shows the control surface servo linear variable differential 
transformers (LVDT) that are used to close the servo loops and also to monitor failures. 

8.1.2 COMPUTER ARCHITECTURE 

The Selected System uses three different types of computers: the ACT Primary 

Computers, the Essential PAS Computers, and the ACT Maintenance and Display 
Computer. Each shares the following characteristics: 

• Digital implementation for design flexibility and self-test capabilities 

• Fault-tolerant design for flight-crucial and flight-critical function implementation, 
including capability to recover from transient failures 

• Fault detection and identification capability to enhance maintainability of the 
overall system 

8. 1.2.1 ACT Primary Computers 

The ACT Primary Computer provides commands for flight-critical ACT functions. This 
computer shares many of the architectural features of the Airborne Advanced 
Reconfigurable Computer System (ARCS) computer described in Reference 6 and is 
similar to flight control computers used in the current generation of commercial 
transports. The ACT Primary Computers are used in a triply redundant set, with each 
computer having identical hardware and software. The computers are loosely 

synchronized on a 20-ms major frame. 

The major sections of the ACT Primary Computer are central digital processing, 
input/output (I/O), servoelectronics, discrete output voters, and power supplies. Figure 42 
is a block diagram of the computer. The digital processing section includes the central 
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Figure 42. ACT Primary Computer Block Diagram 














processing unit (CPU), program memory, variable memory, iteration reference timer, and 
self-monitor circuits. The CPU is a general-purpose, 16-bit parallel processor with an 
instruction set structured to accommodate flight-critical control functions. The memory 
includes a minimum of 20K read-only memory (ROM) for program storage, with 
expansion capability to at least 32K, and 2K of read and write random-access memory 
(RAM) for variable storage. The iteration reference timer generates an interrupt signal 
to the CPU to provide a 5-ms minor frame. The reference timer also provides signals to 
the I/O section. Self-monitor circuits include a watchdog timer, power monitor, 
arithmetic overflow monitor, memory parity monitor, and digital communication 
monitors. The watchdog timer confirms that the CPU is responding to reference timer 
interrupts and can perform a series of tasks. It also checks the operation of the reference 
timer. The power monitor checks voltage levels and generates interrupts when voltage 
drops below required levels and when it returns to proper levels. Power monitor 
interrupts are nonmaskable. The arithmetic overflow monitor generates an interrupt 
whenever an operation is performed that results in an overflow. The memory parity 
monitor checks validity of data received from memory by generating a fault interrupt if 
parity is incorrect; i.e., the data word contains the wrong number of ones. Digital 
communication monitors check for errors in data transmitted over serial bus lines. These 
monitors are physically located in the I/O section of the computer in digital I/O 
interfaces. 

Data flow within the digital processing section of the computer is via internal parallel 
buses. 

The I/O section of the computer consists of analog, digital, and discrete interfaces, plus 
an autonomous controller and dedicated memory. This section provides communication 
between the digital processing section and external devices such as sensors and 
servodrives. Table 9 summarizes the I/O requirements of the ACT Primary Computers. 

Each I/O interface has a dedicated variable memory associated with it. Data are placed 
into or taken directly from this memory, which can also be addressed by the CPU. The 
analog input section includes signal conditioners, antialiasing filters, demodulators, and 
analog-to-digital (A/D) converters. The analog output section includes digital-to-analog 
(D/A) converters and amplifiers. The discrete I/O section provides buffers for system 
discretes at required voltage levels. The digital I/O section includes Aeronautical Radio 
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Table 9. ACT Primary Computer Inputs and Outputs 



Inputs 

Outputs 

Power 

ACT channel 28V dc power 


Digital 

Air data (ARINC 429) 

Inertial reference (ARINC 429) 

ACT Maintenance and Display Computer 
(ARINC 429) 

Essential PAS Computer (ARINC 429) 

ACT Maintenance and Display Computer 
Essential PAS Computer (ARINC 429) 
Cross channel (high speed) 

Analog 

FMC acceleration, left and right 
GLA acceleration, left and right 
Column force 
Dynamic pressure 
Stabilizer position 
Flap position 
Wheel position 
Center-of-gravity acceleration 
Outboard aileron outer segment servo 
spool valve position, left and right 
Rudder servo spool valve position 
Outboard aileron inner segment servo 
loop current, left and right 
Outboard aileron outer segment servo 
position, left and right 
Outboard aileron inner segment servo 
position, left and right 
Outboard flaperon servo position, 
left and right 

Outboard flaperon servo position, 
left and right 
Rudder servo position 
LVDT reference voltage 

Rudder position command 

Outboard aileron outer segment position command 
Outboard aileron inner segment position command 
Outboard flaperon position command 
Inboard flaperon position command 

Discrete 

Air and ground logic (2) 

Test initiate (3) 

Electric power monitor (4) 

Hydraulic pressure monitor (3) 

Pneumatic pressure monitor (2) 

Solenoid valve (AAL) position (4) 
Dump valve position (2) 

Outboard aileron inner segment 
servo failure (4) 

Slat position (3) 

Spare (13) 

Warning displays (12) 

Self-test (6) 

Stick pusher activate 

Stabilizer drive (2) 

Shutdown actuators— servo failure (27) 

Shutdown foreign actuators— computer failure (15) 

^^^SHORT 
P ASgp ^ ^ Q f 31 1 sd 

MLC failed 

Spare (30) 




Incorporated (ARINC) 429 serial data receivers and transmitters for communication with 
digital sensors and other system computers and high-speed serial data transmitters and 
receivers for cross-channel communication with the other ACT Primary Computers. A 
signal from the reference timer causes the autonomous I/O controller to load data from 
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the various input sections into the cross-channel transmitter. No CPU action is required, 
thereby allowing transmission of sensor data to other channels after failure of the CPU. 
The controller also transfers computer output data to the cross-channel transmitter on a 
signal from the CPU. The I/O controller is designed to prevent a failed CPU from 
disabling the transmission of sensor data. The cross-channel transmission of sensor data is 
inhibited only when the computer power supplies or the computers are lost. 

The servoelectronics section of the computer provides servo-loop closure and drive 
current for the electrohydraulic servos of the ACT system. 

Discrete output voters are used to provide output discretes to shut down servos or to 
provide angle-of -attack limiter (AAL) actuation. The servo shutdown logic votes on 
outputs from each ACT Primary Computer and provides a signal to activate a servo 
bypass valve for the force-summed actuators or to electrically null the servodrive output 
for the force-displacement actuators. The servo shutdown logic receives signals on the 
status of computers and servos, and if a majority vote indicates either is bad, it shuts 
down the servo. Status signals from computers that are judged to be failed are ignored. 
Majority vote is normally required to shut down the servo, but if only two good computers 
remain and a disagreement occurs between these two, the actuator will be shut down. 
Each computer contains a servo shutdown logic voter for each of the surfaces driven by 
the ACT Primary Computers. 

The AAL voter works in a manner similar to the servo shutdown logic, except when a 
disagreement occurs between two remaining computers; then the output is zero (i.e., the 
AAL actuator is not activated). Because there are only three ACT Primary Computers 
and four AAL actuators, each line replaceable unit (LRU) contains two AAL voters, 
although only one is used on two of the three ACT Primary Computers. 

The power supply section provides power to all sections of the computer. Input power is 
supplied from a 28V dc ACT system bus, which is supplied from a main dc bus and from a 
standby battery bus. LVDT sensor excitation is provided by the ACT system ac buses, 
which are supplied from the dc buses. This same voltage is provided as a demodulation 
reference. Computer power outputs can sustain a short circuit without causing failure to 
internal voltage supplies. 
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8. 1.2.2 Essential PAS Computers 


The Essential PAS Computers provide crucial pitch augmentation. These computers 
require far less processing and I/O capability than the ACT Primary Computers but 
require higher reliability. The objective of the design of these computers is to keep them 
simple to enhance reliability. These computers are used as a quadruply redundant set and 
operate asynchronously. 

Like the ACT Primary Computers, the Essential PAS Computers include a digital 
processing section, I/O section, servoelectronics, discrete output voter, and power 
supplies. Figure ^3 is a block diagram of the Essential PAS Computers. The CPU 
requirements are such that they can be met by currently available 16-bit microprocessors. 
Use of a microprocessor saves size, weight, and cost and should provide improved 
reliability. It adds some constraints, as it is not feasible to design a microprocessor 
tailored to this application for a current technology system. This may lead to some 
simplification of the self-monitor circuits. The arithmetic overflow monitor may not 
produce an interrupt but instead may require a flag to be read under software control. 
The memory parity monitor is deleted. All other monitors are functionally the same as 
those in the ACT Primary Computers. Memory is reduced to IIK of ROM and 
approximately 256 words of RAM. Real-time programs are contained within 

approximately 2K words of the UK of ROM, and this memory is physically separate from 
the non-real-time program memory. 

The Essential PAS Computers require significantly less I/O than the ACT Primary 
Computers. Table 10 summarizes the I/O for the Essential PAS Computers. Analog 
sensors are cross strapped (i.e., each of the four computers receives a signal directly from 
all analog sensors), so the autonomous I/O controller has been deleted from the Essential 
PAS Computers. All I/O is done with CPU control. As a result of the reduced I/O 
requirement, the system requires relatively low cross-channel data rates and a high-speed 
cross-channel data link is not required. An ARINC ^29 standard bus may be used. This 
provides uniformity of digital communication interfaces. 

Servoelectronics, discrete output voters, and power supplies are functionally the same as 
in the ACT Primary Computers, except the power supply must provide a +12V dc 
excitation for the pitch-rate sensor. One discrete output voter is required in the Essential 
PAS Computer to provide servo shutdown logic for the elevator servos. 
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Figure 43. Essential Pitch-Augmented Stability Computer Block Diagram 













Table 10. Essential Pitch- Augmented Stability Computer Inputs and Outputs 



Inputs 

Outputs 

Power 

ACT channel 
28V dc power 

±12V dc sensor excitation 

Digital 

(ARINC 429) 

ACT Primary Computer 

ACT Maintenance and Display 
Computer 

Cross channel (3) 

ACT Maintenance and Display Computer 
Cross channel 

Analog 

Pitch rate (4) 

Elevator servo spool 

valve position i ^ 2 ) 

Elevator servo position ( 4 ) 

LVDT reference 

Elevator position command 

Discrete 

Air and ground logic (2) 

Test initiate (3) 

Electric power monitor (4) 

Hydraulic pressure monitor (3) 

P^^SHORT^'' 

PASgpEED fail 3 

MLCfail (3) 

Spare 01) 

Warning displays (2) 

Self-test (6) 

Shutdown actuator— servo failure 
Shutdown actuator— computer failure (4) 

Spare ( 17 ) 


8. 1.2.3 ACT Maintenance and Display Computer 

The ACT Maintenance and Display Computer collects data from the ACT Primary and 
Essential PAS Computers and analyzes it to provide fault identification for maintenance 
purposes and also to provide flight crew advisory and warning messages. The ACT 
Maintenance and Display Computer also provides access to the other system computers 
for maintenance testing. These tasks do not require high processing speeds and could be 
performed by an 8-bit microprocessor. Detailed requirements for this noncritical 
computer have not been determined, but 32K of program memory plus a 512-word 
nonvolatile variable memory for fault-table storage have been specified for cost and 
weight estimating purposes. This provides sufficient margin to incorporate any foreseen 
function into the ACT Maintenance and Display Computer. 


8. 1.2.4 General Characteristics 


Table 11 summarizes general characteristics of the ACT Primary and Essential PAS 
Computers. These characteristics are discussed further in the following paragraphs. 
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Table 1 1. Selected System Computer Characteristics 


Computer 

Item 

ACT Primary 

Essential PAS 

Processing speed 

400K ops 

75K ops 

Memory requirements 

24K ROM 

11K ROM 

2K RAM 

256 RAM 

Inputs and outputs 

3 ARINC 429 digital inputs 
2 high-speed digital inputs 
25 analog inputs 
40 discrete inputs 
2 ARINC 429 digital outputs 
1 high-speed digital output 
5 analog outputs 
96 discrete outputs 

5 ARINC 429 digital inputs 
12 analog inputs 
32 discrete inputs 
2 ARINC 429 digital outputs 
1 analog output 
32 discrete outputs 

Interrupts 

Minimum 4-level priority 

Minimum 4-level priority 

Reference timing 

5-ms minor frame 
20-ms major frame 

10-ms frame 

Weight 

11.3 kg (25 lb) 

6 kg (13 lb) 

Reliability 

6800-hr MTBF 

12 000-hrMTBF 


Processing Speed and Memory Requirements— Estimates of processing speed and memory 
requirements are based largely on laboratory test development. These estimates are 
discussed in more detail in Subsection 8.3.3. 

Input/Output— The I/O data in Table 11 summarize the detailed information in Tables 9 
and 10. The I/O sections constitute much of the physical size and weight of the 
computers and have a major impact on cost. 

Interrupts— Both the ACT Primary and the Essential PAS Computers are largely interrupt 
driven. The computers require a minimum of four priority interrupts to provide power, 
reference timer, computer fault, and externally generated I/O interrupts. All interrupts 
except the power interrupt are to be software maskable. 
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Reference Timing— Both computers perform real-time control operations using signals 
from a reference timer for scheduling. The ACT Primary Computers are multirate 
scheduled to provide real-time iteration rates with periods of 5 , 10, and 20 ms. Figure ^4 
shows typical scheduling of control activities for the ACT Primary Computer. The 
Essential PAS Computers operate at a single rate with real-time operations scheduled at 
10-ms intervals. 

Physical Size and Weight— The ACT Primary and Essential PAS Computers have been sized 
to conform to the ARINC 600 standards for packaging of digital avionic equipment. While 
this is not a specific requirement for active controls computers, it provides a comparison 
with other Baseline equipment and offers a configuration that would be readily accepted 
for installation reasons. 

Relicibility-ACT system reliability is discussed in detail in Subsection 9.2. 

8.1.3 ACTUATION SYSTEMS 
8. 1.3.1 Hydraulic Actuators 

Two basic actuation configurations are being considered for the multiple-function ACT 
actuation system: the secondary actuation configuration and the fly-by-wire (FBW) power 
control unit configuration. In the secondary actuation configuration, the ACT control 
signals control secondary actuators to produce a mechanical signal that is series summed 
with the pilot's mechanical input. The combined mechanical input controls the servovalve 
of the power control unit, which, in turn, drives the control surface. In the FBW power 
control unit configuration, the ACT control signals are fed directly to the power control 
unit. For most of the control surfaces used to perform ACT functions as well as basic 
flight controls, the secondary actuation configuration is used. The FBW power control 
unit configuration is used to drive the inboard portion of the outboard aileron and the 
flaperons. Figures 11 and 12 show both configurations, and Table 12 shows which type is 
assigned to each surface. In either configuration, system-failure-induced transients 
should be held to a minimum and hardover surface failures must be prevented. Thus, 
certain redundancy concepts, such as the active, standby type that usually induces large 
failure transients and takes much time for switching, are not acceptable for ACT 
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Figure 44. ACT Primary Computer Scheduling Diagram 
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Table 12. ACT Actuator Characteristics Summary 



Surface actuator 

Secondary actuator 

Type 

Number 

per 

airplane 

Maximum 

output, 

N-m 

Average 

rate, 

deg/s 

Maximum 

deflection, 

deg 

Maximum 

noload 

rate, 

deg/s 

Open- 
loop gam, 
rad/s 

Type 

Number 

per 

airplane 

Design 

rate, 

deg/s 

Open 
loop gam, 
sec 

Authority, 

deg 

Configuration 

Outboard 

aileron, 

outboard 

portion 


■ 

1 500 

85 

+15 

-30 

120 

20 


■ 


80 

+15 

-30 

Secondary 

actuator 

Outboard 

aileron, 

inboard 

portion 

8 

2 

1 200 

100 

+15 

-30 

130 

40 

No secondary actuator used 

Outboard 

flaperon 

[4> 

■ 

1 240 

85 

+15 

-30 

120 

40 

No secondary actuator used 

Inboard 

flaperon 


■ 

3 400 

85 

+15 

-30 

120 

40 

No secondary actuator used 

Elevator 


6 

7 344 

40 

+20 

-30 

55 

20 


3 


80 

+12 

-12 

Secondary 

actuator 

Rudder 


H 

20 902 

40 

+25 

55 

20 


2 


80 

m 

Secondary 

actuator 


[T]]2> Surface actuator controls surface, secondary actuator controls surface actuator 
Hydraulic power requirements 

• Proof pressure 37 233 kPa, high pressure 20 700 kPa. low pressure ^ 

350 to 690 kPa 

• Extreme temperature- -54° to 125°C 
« Operating temperature -40°to71°C 

Side-by-side actuator, two for each surface, mechanical input/mechanical feedback 
Dual-tandem electrohydraulic actuator 
Two side-by-side electrohydraulic actuators 


Same as 2 except three for each surface 

Side-by-side force-summed secondary actuators- 
each actuator contains LVDT, bypass filter, and 
centering spring with maximum force of 230N 
Maximum output force is limited to 1780N 
Each secondary actuator has maximum rate of 
127 mm/s and 38-mm stroke with linkage and 
mechanism. Stops make authority differences 
This rate exceeds maximum no-load rate of the 
surface actuator, except rudder rate is 35 deg/s 


application. Several actuation redundancy schemes that satisfy the design criteria have 
been considered. Based on practical design considerations, two of the most promising 
concepts have been selected for the ACT actuation system. 

Force-Summed Concept— As shown in Figure ^5, the first concept is a force-summed, 
multiple-channel, detection-correction system. Each actuation channel contains a two- 
stage electrohydraulic servovalve that converts the input electric signal into hydraulic 
flow. The hydraulic flow displaces the actuator piston against the centering spring. A 
position transducer (LVDT) is used to close the position loop. A load limiter that limits 
the pressure difference across the actuator piston is used to limit the maximum output 
force to 1800N (400 Ibf). This force is available to prevent minor jams. For normal 
operation, the force output required is on the order of 90N (20 Ibf). For a three-actuator 
system, a pogo (force detent) is also provided to serve as an additional antijam device. 
The pogo load is set to exceed the maximum output force of one actuator but be below 


137 











































































Computer 



© 


Electronics (servoamplifier, 
resistors, etc 
LVDT and demodulator 
(loop closed) 

LVDT (failure detection) 
Hydraulic shutoff value 
(bypass) 

Valve feedback spring 
Electrohydraulic valve 
(servo) 

Electrohydraulic valve 
spool 

Centering spring 
Actuator 

Pogo (three channels only) 
Connectors 


Power 

control 

unit 

command 


Figure 45. Force-Summed Actuation Concept 


the combined maximum output force of two actuators. Thus, if one actuator completely 
jammed, the combined force of the other two actuators would collapse the pogo and the 
system would remain fail-operational. Hardware used in this application is a lightweight, 
off-the-shelf secondary actuator with performance proven in other Boeing programs. Two 
or three redundant actuators are used for each ACT function, depending on the 
redundancy requirements of the particular function. The two-actuator system with 
mathematical model provides a single fail-operational capability, and the three-actuator 
system with mathematical model provides fail-operational/fail-operational capability. 

For failure monitoring and fault detection, an additional LVDT and electronics are used to 
provide a mathematical model of valve spool position. Each servovalve spool position is 
compared with the other and with the mathematical model to determine system integrity. 
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LVDTs are used to measure valve spool positions. The inner servo loop may be closed 
electrically if there is a design advantage. Normally a mechanical spring is used as 
feedback for the valve spool. The piston position transducers (LVDTs) are used to close 
the actuator position loop. Because the LVDTs are tied together, any component failure 
in one channel would result in a large valve spool position disagreement and would be 
easily detected. Arm and interlock logic are also provided in the computers to prevent 
faulty detection and correction during system startup. 

The servovalve failure detection circuit can be straightforward. For a valve failure like a 
stuck or jammed valve, oscillatory failure, or a hardover valve, sufficiently large position 
errors between spools will be produced to allow easy detection. An elaborate spool 
dynamic model is not necessary to sense these kinds of failures. The mathematical model 
is expected to be a simple gain change or first-order lag. This is combined with 
comparators, thresholds, and time delays to denote failures. A low-pass filter may be 
needed to smooth spool position LVDTs to match the mathematical model. A simulation 
study of the force-summed actuator system with a mathematical model and detection 
circuits has been done to verify fully the feasibility of the system and to find the 
requirements of the mathematical model, the failure threshold level, filtering, and timing 
requirements of the failure logic. The study results are described in Subsection 9.1.2. 

The force-summed secondary actuator traditionally suffers some inherent force-fighting 
problem among channels. This problem is caused by component tolerances in each 
channel, resulting in each channel seeking its own position in a high-gain servo loop. 
Force fighting increases system hysteresis and causes a "dead zone" when an even number 
of actuation channels are active. Force-fighting problems can be resolved by using a low- 
pressure-gain servovalve or by using channel equalization circuits. These methods would 
either reduce system performance or add additional hardware. Typical channel mismatch 
conditions that cause force fights are as follows: 


Input mispatch 5% 

Position feedback 1% 

Servovalve null shift 1% 

Servoamplifier tolerance 1% 

Equalization loop mismatch 1% 
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Notice that the equalization loop itself causes 1% mismatch. The major portion is 
obviously caused by input mismatch (presumably in an analog circuit system). The ACT 
computers use signal selection and failure detection (SSFD) and frame synchronization, 
and they produce essentially identical command signals to the surface actuators. Input 
mismatch is not a problem, and a little force fight between channels will not significantly 
degrade system performance. By using high-quality, low-gain servovalves, servo- 
amplifiers, and LVDTs to minimize tolerance mismatches, it is believed that equalization 
loops between channels are not required. Assuming the force-fight problem can be 
reduced, then the associated problems such as increased hysteresis and dead zone become 
less significant and the force-summed secondary actuators will perform satisfactorily. 

This forced-summed, multiple-channel, detection-correction system concept covered 
herein applies specifically to the ACT secondary actuators. Force-summed FBW power 
control units are covered in Subsection 8. 1.3. 3. 

Force-Displacement Hybrid Concept— The second concept is shown in Figure 46. This 
concept was developed by the Parker-Hannifin Corporation of Irvine, California, intended 
for advanced FBW applications. A similar prototype unit has been laboratory tested by 
the Boeing Flight Control Research Group with acceptable results. 

Four two-stage electrohydraulic servovalves with mechanical feedback spools are used. 
Two valves are grouped to each hydraulic system and position summed by a linkage. The 
two linkages are force summed and connected to the main control valve spool. Each first- 
stage valve positions the corresponding spool (fig. 46) proportionally to the sum of 
currents through the multiple coils. Because each valve receives the same combination of 
currents, the four spools should track each other within the accuracy of the mechanical 
servo loop. Any significant rotation of either summing linkage would indicate abnormal 
operation. An LVDT is used to measure this rotation, and the two valves associated with 
the rotating linkage will be shut off if the measurement exceeds a threshold. In addition, 
the actuators are monitored by computers using a cross-channel monitor scheme. The 
unit will provide fail-operational capability. The main feature of this unit is the 
electrical and mechanical channel independence; i.e., a failure of an electric component 
will not affect any mechanical component in the same channel or vice versa. 
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Figure 46. Force-Displacement Actuation Concept 


The actuator will be used without gain compensation under failure conditions. Without 
gam compensation, an electric channel disconnection would reduce actuation loop gain by 
one-third. Acceptable dynamic performance is expected under failure conditions. 









Both concepts (i.e., force summed and force-displacement hybrid) would be compatible 
with the ACT design philosophy, computer redundancy arrangement, and total system 
complexity. However, for the secondary actuation configuration to achieve the same 
design goal, the force-displacement concept requires more hardware. In the pitch axis, 
for example, to achieve a fail-operational/fail-operational capability requires eight 
electrohydraulic valves while the force-summed concept requires only three. The simple 
system should provide comparable system reliability with less cost and weight impact. 
The force-summed concept is selected for the secondary actuation configuration. 

For the FBW power control unit configuration, the force-displacement concept was chosen 
to drive the inboard portion of the outboard aileron. The Boeing laboratory test of a 
prototype unit demonstrated that for the required loads, the rate, frequency response, 
hysteresis, and failure transients of this actuator concept are compatible with the ACT 
flutter-mode control (FMC) and gust-load alleviation (GLA) control laws for this control 
surface. (The somewhat simpler force-summed FBW power control unit concept was 
chosen to drive the less demanding flaperons.) Table 12 lists parameters of all control 
surface actuation systems in the technology base ACT airplanes. 

8. 1.3.2 AAL Pneumatic Actuator 

The AAL system senses an impending stall condition and provides the pilot not only aural 
and tactile warning (stick shaker) but also applies forward torque to the pilot's and 
copilot's control column (stick pusher). This is accomplished by employing a dual tandem 
floating actuator to pull the control column forward when the actuator is pressurized. 
Figure 47 shows a block diagram of the system. Three electric channels and two 
pneumatic channels are used to ensure fail-operational capability against either 
inadvertent actuation or failure to actuate when needed. The actuator will provide a 
starting force of 356N (80 Ibf) when pressurized by either one or both sides. As shown in 
Figure 47, the installation linkage is such that the force exerted on the control column is 
continuously reduced as it travels forward. 

8. 1.3.3 Flaperon Actuation System 

The flaperon actuation system poses a difficult design problem. Although operation will 
likely be required only when the trailing-edge flaps are fully retracted, the flaperon 
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Figure 47. Stick Pusher Actuation Concept 
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actuation installation must accommodate the large flap motion during extension. At least 
two actuators and two hydraulic power systems are required for each flaperon to meet the 
redundancy requirements. Major structural damage could conceivably cause the loss of 
two hydraulic systems. Alternative designs are available by using power-by-wire (PBW) 
techniques. A PBW system uses electric wiring to transmit power in lieu of hydraulic 
lines. The advantage of a PBW system is that local damage or failure to the wiring and 
equipment will not cause the loss of the affected electric power system(s). Currently, 
there are two different PBW approaches under development. The first is called an 
electromechanical actuator (EMA), which uses electric power directly. The second is 
called integrated actuator package (lAP). Electric power is transmitted by wire and 
converted to hydraulic power at the actuators. 

The following three viable flaperon actuation systems were studied: 

• Hydromechanical actuation system 

• Electromechanical actuation system 

• Integrated actuator package 

Following completion of the study, an assessment based on performance, weight, cost, and 
reliability was made on these systems. The results of the assessment indicated that the 
optimum system is the hydromechanical actuation system. The hydromechanical system 
is described in the following paragraphs. The other two configurations are covered in 
Volume II, Appendix D. 

Hydromechanical System— The hydromechanical actuation system consists of two 
actuators and two flaperon lock systems powered by aircraft hydraulic power and electric 
power. The hydraulic power and ACT electric control signals are supplied to the flaperon 
as shown in Figure 48. Hydraulic power is transmitted to the actuators through hydraulic 
lines and swivel joints. These hydraulic lines and swivel joints are well shielded from the 
runway and tire debris by the flap support fairing. The swivel joints possess the same high 
degree of reliability as the swivel joints that provide flow to the Boeing spoiler actuators 
on the 727 and 747. 

As shown in Figure 18, two actuators and two hydraulic power systems are required for 
each flaperon to meet its redundancy requirement. A major concern is that a flap loss 
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Figure 48. Flaperon Actuation (Hydraulic Power Through SwivelJoints) 


would cause the simultaneous loss of two hydraulic systems. Because of this, the proposed 
design provides power capability from two hydraulic systems, but only one hydraulic 
power system is directly connected to the flaperon actuators. Hydraulic power to the 
actuators is normally supplied by hydraulic system A. Only one set of hydraulic lines is 
brought to the actuators through swivel joints. A motor-pump unit is used to connect 
hydraulic system B to hydraulic system A for power redundancy. In normal operation the 
motor-pump unit is stalled and is therefore inactive. Should hydraulic system A fail, the 
hydraulic motor in system B will automatically provide power to the pump in system A. 
The pump in system A will pressurize the hydraulic fluid in the local flaperon area with 
makeup fluid from the level-sensing reservoir. If a major fluid leakage occurs in the local 
area or if the flaperon is lost, hydraulic systems A and B will remain operational. 
System B will remain operational because it is not directly connected to the flaperon. 
System A will remain operational because the level-sensing reservoir and the normally 
closed shutoff valve will respond to block the path of the fluid flow to the flaperon. 
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Flaperon Servoactuator System— The actuators shown in Figure 18 are force-summed 
actuators. Each actuator possesses the full force and rate capability required to drive the 
flaperon. Figure 49 shows a schematic of the servoactuator. Hydraulic pressure to the 
servoactuator and flaperon lock system is controlled by a solenoid valve driving a bypass 
valve. The solenoid valve is a normally closed valve driven by dual coils. The bypass 
valve has the following modes of operation: 


/■ 


Inboard 

actuator 



Figure 49. Flaperon Servoactuator System Schematic 
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• Normal Mode — When the solenoid valve is energized, it allows hydraulic pressure to 
actuate the bypass valve to a position that ports hydraulic fluid to the servoactuator 
and the flaperon lock system. In this mode the hydraulic fluid unlocks the flaperon, 
thus allowing the servoactuator to control the position of the flaperon. It should be 
noted that the failure of one solenoid coil will not affect operation of the solenoid 
valve. 

• Failed Mode — When the solenoid valve is deenergized, it allows the bypass spring to 
drive the bypass valve to a position that blocks the path of the hydraulic fluid to the 
servoactuator, interconnects the actuator cylinder ports (thus eliminating its 
capability to induce force fights), and depressurizes the lock system. This action 
also can be triggered by a hydraulic system failure or failure of both solenoid coils. 

The actuator is an equal-area actuator that is driven by a two-stage jet pipe servovalve. 

An LVDT is used for loop closure as shown in Figure 50. 



Legend: 
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cm 

centimeter, actuator position 

CQ 
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feedback transducer gain 
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mA 
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VC 

actuator position command voltage 
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volts, feedback 

f 

damping ratio 

a? 

frequency, rad/s 

5 

Laplace operator 


Figure 50. Flaperon Control Loop Diagram 
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Flaperon Lock System-Surface locking is used in the event of total hydraulic power loss 
to the flaperon actuation system. Upon shutdown, it is also desirable that the flaperon be 
locked in the neutral position to prevent asymmetry and loss of lift on landing. The 
flaperon lock system is shown in Figure 51. The flaperon lock and unlocking system uses a 
spring force to lock the flaperon at the 0-deg position following failure of both 
servoactuator loops or both hydraulic systems. The flaperon is unlocked by a dual 
hydraulic piston. The area of the hydraulic piston is sized so that either hydraulic system 
can unlock and hold the flaperon in the unlocked position. With power loss to the flaperon 
actuation system, this locking system, with its 3560N (800-lbf) force spring in conjunction 
with the cam and lever-roller arrangement, can drive the flaperon to neutral (and lock) 
from the maximum free-float up angle against the maximum holddown hinge moment (two 
required per flaperon). 
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Failure Detection Scheme— The flaperon is a flight-critical surface driven by two force- 
shared actuators that are located 4.3m (14 ft) apart. The distance between the two 
actuators allows the structure to absorb the mismatches of the two actuators. If the 
actuators are driven in opposite directions at maximum force, the windup in the shaft 
would be 4.7 deg. It should be noted that the torsional stress induced by the windup will 
not cause the shaft material to exceed its torsional stress limit. The windup capability of 
the shaft allows selection of a failure detection scheme that monitors the complete 
servoactuator closed-loop performance. 

The failure detection scheme is shown in Figure 52. A command signal from the 
controller drives the servoactuator control loop and a model of the servoactuator control 
loop. The position output of the servoactuator control loop is compared to the position 
output of the model. If one of the components in the control loop fails, then the outputs 
of the control loop and model will deviate. The actuator is considered failed when this 
differential error exceeds 696 of actuator full stroke. Once the differential error exceeds 
6%, the computer will immediately deactivate the bypass valve on the failed actuator. 
The same magnitude of error or a failure of the second hydraulic system will cause the 
second actuator to switch to the bypass mode, thus allowing the spring lock system to lock 
the flaperon in its 0-deg position. 

System Installation- The servoactuator and the flaperon lock system installed in the 
flaperon fairing are shown in Figure 51. 
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Figure 52. Flaperon Failure Detection Schematic 


150 
















8.2 REDUNDANCY MANAGEMENT 


Redundancy management is the process that enables continued operation of the Active 
Controls Technology (ACT) system in the presence of transient or permanent failures of 
the control system hardware. Critical to this operation is the concept of coverage, which is 
defined here as the probability that the system correctly detects component failure(s) and 
successfully reconfigures the other components to maximize function success paths. This 
philosophy for the ACT system includes the following: 

• System elements are monitored for faults using a combination of hardware and 
software. 

• Faults are primarily detected by cross-channel comparison. Inline and inchannel 
monitoring supplements cross-channel comparison and provides fault isolation. 

• Detected faults are isolated and switched out where possible to prevent any 
detrimental effect on airplane performance. Critical systems will survive at least 
single failure, except actuator jam, without affecting performance. Crucial systems 
will survive at least two similar failures, including a jam. 

• Following clearance of a transient fault, the system will recover to the redundancy 
level in effect prior to the failure. 

• Following a failure that leaves only two success paths for a function, a disagreement 
in those paths will lead to shutdown of the function or reconfiguration to a degraded 
mode. Single-thread operation will be allowed only if it can be shown that the 
function satisfies conditions stated in Subsection 5.2.2. 

Redundancy management goals can be achieved by system monitoring and reconfiguration 
and additional failure protection through design features such as physical and functional 
isolation in redundant channels, supplying of electric power from redundant sources, and 
hydromechanical voting. System monitoring and reconfiguration are performed under the 
control of the ACT Primary Computers and Essential Pitch-Augmented Stability (PAS) 
Computers on three separate planes: sensors, computers, and servoactuators. Figures 53 
and 54 illustrate the redundancy management processes performed by each computer. 
These processes are discussed in the following subsections. 
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Figure 53. Redundancy Management Processes, ACT Primary Computer 
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Figure 54. Redundancy Management Processes, Essential Pitch-Augmented 
Stability Computers 


















8.2.1 SIGNAL SELECTION AND FAILURE DETECTION 


Protection against failures of the sensors, wiring, and input sections of the computer is 
provided by the signal selection and failure detection (SSFD) processes. Each computer 
uses signal selection to select a single value from each set of redundant sensors, and it 
uses failure detection and reconfiguration processes to isolate failed signals. Because 
sensor configuration differs between the ACT Primary Computers and Essential PAS 
Computers, they will be discussed separately. In both cases, SSFD is performed primarily 
by software. 

8.2. 1.1 ACT Primary Computer SSFD 

Each ACT Primary Computer sees identical sensor information received from direct 
connection to the sensor or from the cross-channel data link. The signal selection takes 
two basic forms, depending on the type of sensor, as illustrated in Figure 55. Equalization 
IS used on most signals. For those sensors that normally have dc components (such as 
airspeed, angle of attack, etc.), the last "good" value is held when two of three sensors 
fail. For those sensors with values that are normally zero (such as pitch rates), the 
selected value is set to zero when the sensors fail. Some sensors are filtered through a 
washout upstream of the signal selection (e.g., wing acceleration for gust-load alleviation 
and flutter-mode control), and the equalization is deleted. These signals are set to zero in 
the event of sensor failure. 

Equalization is used to minimize transients due to sensor failure. Equalization takes the 
error signal, which is the difference between the equalized local signal and the selected 
signal, and passes it through a high-gain lag filter to form an equalization signal. The 
equalization signal is then subtracted from the local raw signal to form an equalized local 
signal. The signal selector acts on the equalized signals. This method does not provide 
exact equalization but can be used to reduce transients to levels that will not affect 
airplane performance. 

Failure detection is done by comparing input signals. For signals that have been 
equalized, the error signal represents the difference between the equalized signal and the 
selected signal, which is used as a reference. Because the error signal represents 
differences between the equalized signal and the reference, steady-state errors are 
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masked and this signal may be used to detect dynamic faults. This gives rapid response to 
step failures and detection of high-frequency oscillatory failures. The equalization error 
represents the difference between the raw and the equalized signal, which in steady state 
is approximately the same as the difference between the raw signal and the selected 
signal, so the equalization error may be used to detect static failures. The two separate 
error detectors allow different thresholds and detect times for dynamic failures than for 
static errors such as drift and bias errors. For signals that are not equalized, there is only 
a single detector, which compares differences between raw signals. Because these signals 
are washed out upstream, this is essentially a dynamic type of fault detector. 

Each detector uses a counter scheme to prevent nuisance trips and provide oscillatory 
failure protection. If the threshold is exceeded, the counter counts up. If the threshold is 
not exceeded and the counter is not zero, the counter counts down. If the counter 
exceeds a threshold level, the signal is considered failed. The counter is counted up at a 
faster rate than it is counted down so that an oscillatory failure will be detected. 
Figure 56 shows typical flow charts for the failure detection schemes. 

Signal selection operates on those signals that have not exceeded thresholds. When a 
signal has been determined to be failed, sensors are reconfigured to exclude that signal 
from the selection process, but the fault detector continues to monitor all signals. The 
selection process selects the median signal, when none of the signals is considered failed, 
and averages the two unfailed signals when one of the signals fails. When the second 
signal fails, the selector uses a default value, which may be either the last good value or 
zero, depending on the type of signal. 

A further reconfiguration occurs when two of the three sensors have failed. A default 
value is selected that may provide degraded performance operation. For example, a 
default value selected for a variable used to schedule gains results in a fixed gain being 
used in calculations. If operation with a default value does not provide adequate 
performance, two options are available. The control law may be reconfigured (i.e., 
replaced with another control law not requiring the failed signal), or if no other control 
laws are available, the function will be shut down. 
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8.2. 1.2 Essential PAS Compujter SSFD 


Sensor selection is slightly more complex for the Essential PAS Computers as there are 
now four rather than three computers. For the pitch-rate signal with four sensors, an 
active, online selection process is used. Three signals are considered active and feed 
directly into the selector. All four signals are monitored for failure, but the standby 
signal is not used unless one of the active signals fails. The selection process becomes (1) 
median of active channels with no failures, (2) median of active channels with standby 
channel replacing failed channel after first failure, (3) average of unfailed channels with 
two failures, (U) and a best-value selection with three or more failures. Best-value 
selection uses inline monitoring to select the remaining good signal following the third 
failure. Because inline monitoring does not provide 100% failure detection, it may not be 
possible to determine which sensor has failed. Loss of sensor data for the Essential PAS 
Computer can result in loss of pitch augmentation, which is unacceptable. Therefore, it is 
not reasonable to ignore all sensors. One of the signals is arbitrarily selected if inline 
monitoring does not provide enough information to determine which of the sensors has 
failed. However, reliability analyses indicate that loss of three signals in the Essential 
PAS System is extremely improbable. 

The Essential PAS Computers also select the Full PAS signal from the ACT Primary 
Computers to drive the elevator. In this case there are only three signals; therefore, 
there is no standby channel. The SSFD algorithm is altered to account for simultaneous 
failures, as redundancy management of the ACT Primary Computers masks the effect of 
sensor failures on the output. A single sensor failure will not affect the output, but a 
second similar failure can cause all three computers to shut down their outputs 
simultaneously. The Essential PAS Computer cannot obtain sufficient information about 
the PAS command from the ACT Primary Computers by comparison monitoring alone to 
properly determine the status of that command. Discrete status bits from the ACT 
Primary Computers will be used to augment the monitor information. If a signal fails a 
comparison, or a vote of the status bits indicates a signal is failed, that signal is no longer 
used by the selector. If two or more signals fail, the PAS command from the ACT 
Primary Computers is disregarded and the output from the Essential PAS control law 
computation is substituted. 
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For both ACT Primary and Essential PAS Computers, the sensors are continuously 
monitored. If a failed signal returns to within tolerances for a prescribed period of time 
and inline testing indicates it is good, the sensor is considered recovered and once again 
becomes active. 

8.2. 1.3 Discrete Input SSFD 

Signal selection for discrete inputs (fig. 57) is based upon majority logic voting. 
Monitoring is done by comparing input value to a selected value. If a disagreement occurs 
and persists for more than the specified time, the signal is considered failed. If a failure 
occurs while there are only two remaining signals, the output will revert to a safe state, if 
such a state exists. For example, failure of the air-to-ground logic results in an "in the 
air" state to be assumed, thus preventing entry to a self-test mode in flight. If a safe 
state does not exist, the discrete will default to local input state. 

8.2.2 COMPUTER MONITORING 


Protection against computer faults is provided by computer monitoring and 
reconfiguration. Failures are detected by both cross-channel comparison and inline 
monitoring techniques. 
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Figure 57. Signal Selection Concept for Discrete inputs 
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S.2.2.1 Synchronization 


The ACT Primary Computers are loosely synchronized on a frame basis, primarily to aid 
fault detection. This synchronization is not essential but would be necessary if integral 
feedback were incorporated. Synchronization aids fault detection and reconfiguration, 
but it is not a requirement for these processes. The system is designed to operate 
asynchronously as well as synchronously so that loss of synchronization does not shut down 
the system. 

The ACT Primary Computers are synchronized through the exchange of sync bits. The 
synchronization concept is based on a "wait" algorithm. Each computer sets its sync bit 
and waits until the others set theirs or until a time limit is exceeded. The computer then 
clears its sync bit and checks to see that the other sync bits have also been cleared. If a 
computer fails to achieve sync (i.e., it does not set and clear its sync bit in the prescribed 
manner), that information is recorded for fault isolation use and possible maintenance 
action, but it is not considered as a system fault by itself. 

Because the computers can operate asynchronously, a simple "slow-resync" algorithm may 
be used. If an out-of-sync condition exists, each computer varies its frame starting time 
slightly, so that the computers drift back into sync. Performance during this out-of-sync 
period is not significantly degraded. 

The Essential PAS Computer implements a single fixed-gain control law. Synchronization 
is not required for this function, and the Essential PAS Computers are designed to operate 
asynchronously. 

8.2.2.2 Output Monitor 

The computer output monitor compares the outputs from the different computers. 
Comparison of the digital outputs is made before conversion to analog form. Failures of 
the digital-to-analog converters are not detected by the computer output monitor but are 
tested by the servomonitor. The computer output monitor compares output differences to 
thresholds and uses a counter algorithm similar to the sensor monitor (fig. 56) to 
determine failures. Thresholds for the primary computer can be low, as all computers 


160 



operate on identical data and are normally synchronized. The Essential PAS Computers 
require higher thresholds to allow analog-to-digital tolerances and slight time differences 
due to asynchronous operation. 

If a computer fault is indicated by the output monitor, the computers will send output 
discretes to the servo shutdown logic indicating that the computer output is failed and the 
affected servos will be shut down. If only two computers are considered good when the 
output monitor detects an error, both servos will be shut down. 

The good computers will continue to monitor the faulted computer output. If the faulted 
computer retains its ability to execute its programs and the program memory has not been 
altered and input/output (I/O) capability is retained so that the computer can receive 
information essential to processing, it will attempt to recover. The recovery procedure 
used is a "warm restart." This is a simplified power-up routine that reinitializes control 
function variables and checks to see if the failed output commands return to within 
tolerances of the good computer outputs. The time constants of the control law filters 
for the ACT airplane are such that this will occur within a short time if the fault has 
cleared. If the output returns to within tolerance and stays there for a prescribed period 
of time, the computer will be considered recovered and its actuators put back on line. 
Servo output synchronization routines will be used as required to reduce transients at 
recovery. 

8.2. 2.3 Self-Monitors and Self -Tests 

In addition to the cross-channel comparison monitors, failure protection is provided by 
computer self-monitors and self-tests. These functions are described in Subsections 8.1.2 
and 8.3, respectively. Self-monitoring and self-testing provide extensive coverage of 
latent failures and aid in failure isolation for maintenance purposes. It is expected that 
self-test and self-monitoring can provide at least 95% coverage of computer failures. 

If one of these monitors indicates a fault but the central processing unit (CPU) is still able 
to execute instructions and the program memory is intact, the computer will attempt to 
correct the error. For a watchdog monitor trip, the affected computer will attempt a 
"warm start" recovery as in the previous case, but the servo will not be shut down unless 
the output is out of tolerance for a period long enough to trip the output monitor. 
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Coverage by inline methods is not considered adequate to allow single-channel operation 
if a potentially catastrophic failure mode exists. Single-thread operation is permitted 
only for the lateral/directional-augmented stability (LAS) function, which meets require- 
ments as described in the ground rules (subsec 5.2.2), and the crucial PAS function, as 
there is no reasonable alternative to single-thread operation if a failure occurs when 
system redundancy for this function has been reduced to two. 

8.2.3 SERVOMONITORING 

Faults in the servos, as well as in analog output and servoelectronic portions of the 
computers, are handled by the servomonitor. The servomonitor provides cross-channel 
comparison of servo outputs, and in some cases it is compared with an output predicted by 
a mathematical model. There are three different kinds of servos to be monitored: force- 
summed secondary servos, force-summed flaperon power control units (PCU), and force- 
displacement magnetic flux-summed servos. Each servo requires a slightly different 
monitor scheme, and Figure 58 illustrates the monitoring scheme for both kinds of force- 
summed actuators. The positions of the servo spool valves are compared for the 
secondary servos. The flaperon actuator forces are not summed by a rigid link but rather 
by the torque box of the flaperon surface, which allows sufficient windup to compare 
actuator ram position output and determine if a servoactuator has failed. Reliability of 
the servos is such that only two servos are required for critical functions and three for 
crucial functions when single-thread operation of actuators is allowed. Cross-channel 
comparison alone does not provide adequate fault isolation for single-thread operation, as 
a disagreement between two servos only indicates one has failed and not which one has 
failed. A mathematical model in the computer provides an additional channel for 
comparison. The servo spool valve position, or the actuator ram position, is predicted by 
the model, and this prediction is compared to the measured position. This mathematical 
prediction is used primarily for failure identification rather than failure detection, and a 
simple mathematical model that ignores high-order dynamics of the system may be used. 
Aerodynamic forces on the flaperon may also be ignored. Thresholds are set high enough 
to avoid nuisance trips. 

A counting algorithm similar to the SSFD algorithm described in the preceding subsection 
can prevent nuisance trips caused by transients but retain detection of oscillatory 
failures. Once a failure is detected and determined not to be a short transient, the servo 
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Figure 58. ACT Force-Summed Actuation Fault Detection 


is shut down by sending a signal to a voter whose output activates a hydraulic bypass valve 
to shut down the servo. Once a servo has been shut down due to servo failure, it cannot 
be monitored to see if the failure clears, so the servo remains shut down for the duration 
of the flight. 


The magnetic flux-summed servos of the force-displacement actuators use three coils in 
each electrohydraulic valve so each valve receives signals from all three ACT Primary 
Computers. This provides three channels for the electric portions of the actuation system 
even though only two hydraulic channels are used. The electric and hydraulic portions of 
the servo are monitored separately. Figure 59 illustrates monitoring for the electric 
channels. The force-displacement actuators have four electrohydraulic valves, each 
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Figure 59. ACT Force-Displacement Actuation Fault Detection 
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containing three coils. The servodrive from each ACT Primary Computer is connected in 
series with one of the coils in each of the four valves. The currents flowing in each of the 
servodrive loops are compared to check the analog output and servoelectronic portions of 
the computer as well as the coils themselves. The differences between the currents in the 
three loops are compared to thresholds and the counting algorithm used to determine 
failures. If a failure is detected, the servodrive current is electrically nulled by a signal 
from the servo shutdown logic. 

Hydraulic failures are monitored by using pressure switches in hydraulic pressure lines and 
by measuring rotation in the summing linkages for each pair of electrohydraulic valves, as 
described in Subsection 8.1.3. If a failure is detected, the failed valves are hydraulically 
bypassed. 

8.2.4 ADDITIONAL FAILURE PROTECTION 

Additional failure protection is provided for the actuation and for the electric systems. 
Figure 60 summarizes the failure protection features. Actuator outputs are voted through 
mechanical force summing or through a combination of magnetic flux summing and force 
summing. These techniques are described in Subsection 8.1.3. 

Electric power for each ACT channel is derived from two independent sources: one of the 
aircraft main dc transformer-rectifier (T-R) buses and one of the standby batteries. 

Power supply energy storage is sufficient to maintain voltage levels under maximum load 
until battery backup can take over if a T-R bus fails. The probability of temporary loss of 
power is therefore very low (see subsec 9,2.1), and no special procedures have been 
designated for reconfiguration when power is lost. This would be treated as a 
simultaneous failure of all parts of the affected channel. Reconfiguration and recovery 
would follow procedures described in the preceding subsections. 
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8.3 ACT SYSTEM SOFTWARE 


Software is an essential part of any digital system. Software for the Active Controls 
Technology (ACT) system has been designed with the objective of maintaining visibility 
and simplifying verification and validation. 

8.3.1 SOFTWARE DESIGN GUIDELINES 

The design methodology requires using the "top-down" technique with limited application 
of "bottom-up" techniques. Both top-down and bottom-up techniques are organizational 
processes or ordered approaches used to attack a task. The top-down technique starts at 
the "top" or highest level of consideration and uses partitioning designed to separate the 
lower level parts required. The bottom-up technique is the opposite of top-down, in that 
it first considers the parts available and then designs at the next higher level to integrate 
the parts into a unit. 

For a design problem using the top-down approach, the highest starting level is the total 
conceptual statement of the problem and the requirements the solution must meet. Then, 
the next lower level of the solution and the interrelation of its parts are determined. This 
process is repeated for each part on a new level to design the next lower level until the 
lowest level parts of the solution are defined. 

The bottom-up approach first takes the lowest level parts (e.g., a computer instruction 
set) and integrates them into a higher level unit. This process may be repeated at each 
successively higher level, with the lower level integrated units being further integrated 
into higher level units. Successive bottom-up integration is not allowed in the ACT 
design. Design of a bottom-level component is permitted when it is known that it will be 
required even though the top-down design has not proceeded down to the level where it 
would be specified. Control laws are examples of this type of component. There must 
still be a top-down design and specification of the manner in which these components are 
used. 

Programs will be developed using the rules of structured programming, which define 
organization and enforce discipline in the programming process. Programming rules are 
made to ensure uniformity in style and to maximize clarity and visibility of how the 
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program performs its intended task, regardless of how many programmers are involved. 
Modularity is a main concern; it includes the organization of sets of instructions and data. 
Standard control structures are established and program blocks are arranged sequentially 
so that the flow of a program has maximum visibility. A classic objective of structured 
programming is elimination of the GO-TO concept. 

The entire computer resident software should be structured to maximize visibility, 
flexibility, and efficiency. Items to be considered in program design include partitioning, 
program module boundaries, hardware and software interfaces, program module control 
and data interfaces, functional and safety criticality, implementation constraints, and 
software testing. 

8.3.2 SOFTWARE STRUCTURE 

The objective of the overall ACT software task is to provide real-time implementation of 
active controls and adequate failure detection and self-test to ensure safe and reliable 
operation of the ACT system. Using a top-down design methodology, this overall task has 
been divided functionally into progressively lower levels. The resulting functional design 
trees are described in the following subsections. 

8.3.2. 1 ACT Primary Computer Software 

Figure 61 shows the upper levels of the design tree for the ACT Primary Computers. The 
overall task of active control is divided into two parts: real-time control, which performs 
all tasks required for safe flight of the aircraft, and ground operations, which performs 
preflight and maintenance testing while the aircraft is on the ground. The real-time 
control software module is further divided into three tasks: real-time executive, 

foreground tasks, and background tasks. 

Real-Time Control- The real-time executive (fig. 62) provides interrupt processing 
capability necessary for operating the control software in real time. There are four kinds 
of interrupts: power interrupt, timer interrupt, input/output (I/O) interrupt, and fault 

interrupt. Power interrupt software supplies system initialization following application of 
power to the system and performs required tasks when loss of power is imminent. 
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Figure 61. ACT Primary Computer Software Design Tree, Upper Levels 
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Figure 62. ACT Primary Computer Software, Real-Time Executive 











An event timer provides real-time information to the system. The timer interrupt 
software begins processing for a new minor frame following a signal from the timer. 

I/O interrupt processing software facilitates communication with external devices, 
including communication with other computers via the cross-channel data link. 

Fault interrupt software furnishes software processing for four different kinds of faults. 
Cross-channel data link (CCDL) fault software indicates an error in data from another 
computer and makes that information available to the reconfiguration software. 
Arithmetic fault software provides overflow protection. Parity fault software provides 
information about memory failures to the reconfiguration software. Watchdog monitor 
software attempts recovery following a computer failure that prevents reset of the 
watchdog monitor timer. 

Foreground tasks are those control tasks that must be performed in real time. These 
include tasks relating to redundancy management, control law calculation, and, because 
different control laws run at different sampling rates, a multirate scheduler. The 
breakdown for these tasks is shown in Figure 63. 

The synchronization software minimizes the time difference between the start of a major 
frame on different computers. Synchronization ensures that sensor data are sampled at 
nearly the same time by all computers. Normal synchronization causes all computers to 
start a major frame at the same time when the computers are operating within tolerance. 
Resynchronization software acts to synchronize operation of the computers when one or 
more is operating at a different point in a frame than the others. Cross-channel status 
determines which computers are operating and in which minor frame they are operating. 
This information is used to determine if resynchronization is necessary. 

The multirate scheduler schedules control law software. Each control law calculation is 
done only as often as required to get the proper sampling rate. Control laws and the 
associated redundancy management are scheduled at different rates by the scheduler. 

The signal selection and failure detection (S5FD) software (fig. 64) provides sensor failure 
detection, signal selection, and transient suppression. Equalization is used on some sensor 
signals to reduce transients by forcing all inputs to be close to the selected input value. 
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'igure 63. ACT Primary Computer Software, Foreground Tasks 
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Figure 64. ACT Primary Computer Software, Signal Selection and Failure Detection 
















The input processing module determines an equalized input value from the raw signal and 
an error signal based on data from the previous frame. Fault detector software 
determines which sensors are functioning correctly and changes the configuration to 
exclude failed sensors. Two different failure detectors are implemented in software. 
Detector-one compares the difference between the signal and a reference value to a 
threshold. Signals that use equalization use detector-one to determine both high- 
frequency and low-frequency failures. The error signal, which is the difference between 
the input signal and the selected signals, is used for high-frequency detection. The 
equalization signal, which is the filtered error signal, is used for low-frequency and bias 
errors. Detector-two is used when no reference is available and compares differences 
between signals to determine errors. Additional logic determines from the threshold 
comparisons which sensor has failed. Both detectors use a threshold detector plus an 
increment/decrement counter algorithm to detect oscillatory failures. The reconfigure- 
sensors software uses fault detector information to declare temporary and permanent 
faults. Sensors that have been declared failed, either temporarily or permanently, are not 
used in the signal selection process. A temporarily failed sensor is declared good again if 
it returns to proper operation, as confirmed by indicating the correct signal for a period 
of time. This time limit is chosen so that changes in the measured quantity over that 
time period are presumed large enough that the error would be detected even if a sensor 
failed to the nominal signal value. A permanent failure cannot be recovered until 
maintenance action has been taken. 

Signal selection software determines a single value for each parameter from the 
redundant sensor signals. The determine-sensor-configuration module determines how 
many values the selector operates upon. Median select software produces an output equal 
to the median of three input values. The average select module averages the values of 
the inputs when only two sensors remain. The default select module produces an output 
equal to some default value when there are fewer than two valid input signals. This 
default value may be a constant or the previously selected output. 

Following signal selection, the equalization error calculation routine calculates the error 
signal, which is the difference between the raw signal and selected signal. The error 
signal is passed through a high-gain lag filter to form the equalization signal. The 
equalization signal is subtracted from the raw signal in the next frame during input 
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processing to form the equalized input. This routine is bypassed for signals that do not 
require equalization. 

Control law software (fig. 65) calculates surface position commands using selected sensor 
input data to provide the following functions; Full Pitch-Augmented Stability (Full PAS), 
angle-of-attack limiter (AAL), wing-load alleviation (WLA), lateral/directional-augmented 
stability (LAS), and flutter-mode control (FMC). The Full PAS function includes both 
short-period PAS and phugoid PAS modes. WLA includes maneuver-load control (MLC) 
and gust-load alleviation (GLA). 

The output monitor software (fig. 63) detects computer failures that result in erroneous 
digital output. Surface position commands calculated using the control laws are 
transmitted digitally to other channels by the transfer data cross-channel software 
module. The failure detector compares these output values and detects any that are out 
of tolerance using the same algorithm as used by detector-two of the SSFD software 
(fig. 6^). Reconfigure-servos software shuts down the servos of the affected channel 
when a failure is detected and reengages servos following successful recovery, providing 
reengagement synchronization as required to prevent undesirable transients. Recovery 
software reinitializes the computer and checks to see if proper operation resumes. 

The servomonitor software checks the proper operation of the servos. The force-summed 
servoactuators use comparison with a mathematical model to determine which servo has 
failed in the event of a disagreement between the two servos, thus allowing operation 
with a single servo. Mathematical model software is used to predict the spool valve 
position for forced-summed secondary servos and to predict the actuator position for the 
flaperon power control units (PCU). The servo failure detector software compares servo 
parameters to detect failures using the same algorithm used in detector two of the SSFD 
software. Spool valve positions, both measured and predicted by the mathematical model, 
are compared for the secondary force-summed servos. Actuator positions, again including 
a mathematical model prediction, are compared for the flaperon actuators. Servo-loop 
currents in the electrohydraulic valve coils are compared for the dedicated force- 
displacement servos. If a failure is detected, the shutdown servos software acts to 
hydraulically bypass the servo in the case of force-summed actuators or to electrically 
null the output command to the force-displacement summed servos. 
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Figure 65. ACT Primary Computer Software, Control Laws 













Background tasks software (fig. 66) performs tasks in flight to provide information about 
the state of the ACT systems. These tasks are not time critical and are performed on a 
time-available basis following completion of the foreground tasks. However, because 
information on the state of the system is required to be up to date for reliability purposes, 
sufficient time must be allowed for background tasks such that all may be completed 
within a reasonable amount of time. 


The ACT Maintenance and Display Computer interface software provides system status 
information to the maintenance and display computer. The determine-LRU-status 
software consolidates information supplied by system monitors and self-test. The LRU 
status and monitor status is checked to determine functional status by the determine- 
functional-status software, and the result is supplied to the ACT Maintenance and Display 
Computer. 



Figure 66. ACT Primary Computer Software, Background Tasks 
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In-flight tests software provides up-to-date information on the soundness of the system. 
Test results are used to supplement information from the real-time monitors. The in- 
flight tests include reasonableness tests on sensor data, program memory sum checks, 
cross-channel integrity tests, etc., that do not interfere with real-time operation. 

Maintenance support software supplies information about the system so that failures may 
be located and repaired quickly and easily by maintenance personnel. This primarily 
consists of collecting and formatting data from monitors and tests so that data may be 
transmitted to the ACT Maintenance and Display Computer. 

Ground Operations— Ground operations (fig. 67) is the second major task of the software. 
It provides software to perform preflight and maintenance testing. This module is active 
only when certain conditions are met; one condition is that the airplane must be on the 
ground. The software is divided into three parts: ground test executive, preflight test, 
and maintenance test. 

The ground test executive software verifies test conditions and interrupt processing. 
Verify-test-conditions software checks to ensure that the airplane is on the ground and 
then runs the proper test when other conditions are met. The executive includes fault 
interrupt processing software and I/O interrupts processing software. The test scheduler 
software determines which tests are to be run. 

The bulk of the ground operations software is the preflight test (fig. 68), which performs 
tests to determine the state of the system before flight. System components and 
functions must be tested before takeoff to ensure that safety requirements are met. 
These same tests may also be performed at other times for maintenance testing. The 
preflight consists of three different kinds of tests: computer self-tests, system monitor 
tests, and end-to-end tests. 

Computer self-tests software (fig. 69) includes tests to verify the ability of the computer 
to perform correctly. These tests are performed solely by the computer and require no 
external input. The instruction repertoire test software checks the computer central 
processing unit (CPU) to verify that each legitimate operation code executes properly. 
Monitor-checks software tests each computer hardware monitor and verifies that they 
trip when an error occurs. The watchdog monitor test software checks that the watchdog 
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Figure 67. ACT Primary Computer Software, Ground Operations 
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Figure 68. ACT Primary Computer Software, Preflight Test 
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Figure 69. ACT Primary Computer Software, Computer Self-Test 
















monitor trips if not reset by the CPU. It also checks the length of the watchdog monitor 
timing windows. The parity check test software generates words with improper 
parity and verifies that the parity check hardware functions properly. The overflow 
protection test software performs arithmetic operations that result in an overflow and 
verifies that an overflow interrupt is generated. 

Memory-tests software checks that all computer memory is functioning without error, 
ROM-sum-checks software verifies that errors have not occurred in program memory. 
This is done by adding all the operation codes in each block of memory and comparing that 
to a sum check code. Scratch pad read/write test software writes different patterns into 
each scratch pad memory location and then reads it back to verify that proper data are 
stored in memory. Patterns are chosen to show that each bit will set to both a "1" and 
a "0." 

Wraparound-I/O-tests software tests the I/O circuits of the computer by closing a relay 
and wrapping outputs around to the computer inputs. Data are output, and inputs are 
checked after a suitable delay to verify that these same data have been received at the 
input. Four such tests are made, one for each type of I/O. These are analog I/O test, 
discrete I/O test, cross-channel I/O test, and Aeronautical Radio Incorporated (ARINC) 
429 interface test. 

The final computer self-test software module is the dedicated display test module, which 
checks the computer message display capability. The discrete warning lights are tested 
such that the crew can determine if the displays are functioning. 

System-monitor-test software (fig, 68) tests major system functions. All computers must 
run the test simultaneously and depend on data from other computers. This software tests 
the system-level monitors and the major sensors. The major sensor test software asks the 
digital air data computer (DADC) and the inertial reference system (IRS) to perform 
internal tests and then checks the results. The system-level monitor test software 
provides data for normal and failure cases and checks that the monitor correctly 
determines the status. Three software modules perform these tests: the SSFD test 

module, output monitor test module, and servomonitor test module. 

End-to-end tests software checks that the system is functioning properly from sensor 
input to actuator output. This is done in two steps: Electronic end-to-end test software 
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checks all components from the sensors to the computer output. The mechanical end-to- 
end test software checks actuator operation when hydraulic power and ground clearance 
are available. This test checks servoelectronics and hydraulic actuators. The two parts 
of the end-to-end test verify that the system is functional. 

Maintenance tests software (fig. 67) isolates faults and provides information for 
corrective maintenance. Although each test in the preflight may also be used for this 
purpose, the maintenance tests software is defined to include only those tests not also 
included in the preflight. This includes sensor test software, which tests dedicated ACT 
sensors, and full end-to-end test software, which combines the electronic and mechanical 
end-to-end tests of the preflight. 

S.3.2.2 Essential PAS Computer Software 

Software for the Essential PAS Computers is similar to the ACT Primary Computer 
software, except the real-time software is simplified because only one control law is 
implemented in the Essential PAS Computer. Figures 70 through 77 show the design tree 
for the Essential PAS Computer software. The task of the software is to maintain pitch 
stability augmentation and to provide adequate self-test and failure detection. This task 
is divided into two main tasks: real-time control and ground operations (fig. 70). All 
software modules may be considered to be identical in function to similarly named ACT 
Primary Computer software modules except as noted. 

The real-time executive software (fig. 71) performs the same function as described 
earlier, except the Essential PAS Computer does not have a separate autonomous I/O 
controller to initiate analog-to-digital (A/D) conversion, so this must be performed by the 
CPU. The timer interrupt software must now perform two tasks: Analog-to-digital 

converter cycle software signals the conversion hardware to begin producing new values 
before the beginning of a frame. The frame initiate software begins processing a new 
frame. In addition, the fault processing software performs the same function as the fault 
interrupt processing module in the ACT Primary Computers, but the submodules are not 
necessarily interrupt driven. 

It is in the foreground tasks module (fig. 72) that the Essential PAS Computer software 
differs most from the ACT Primary Computer software. The SSFD software (fig. 73) 
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Figure 70. Essential Pitch-Augmented Stability Software Design Tree, Upper Levels 
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Figure 71. Essential Pitch-Augmented Stability Software, Real-Time Executive 
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Figure 72. Essential Pitch-Augmented Stability Software, Foreground Tasks 
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Figure 73. Essential Pitch-Augmented Stability Software, Signal Selection and Failure Detection 













operates on sensor input to be used by the fixed-gain short-period PAS module. The SSFD 
software is similar to the ACT Primary Computer software with one major exception. 
The Essential PAS Computer SSFD must deal with four redundant sensors rather than 
three. All four signals are monitored by fault detector software at all times, but a 
maximum of three signals is used by the signal selection software; one signal is designated 
a standby and is not used until one of the other signals fails. If one of these signals fails 
while the standby is good, the median select software is still used, but with 
the standby signal used in place of the failed signal. If two failures occur, the average 
select software acts on the two remaining good signals. If a third sensor failure occurs, 
the fault detector provides insufficient data to determine which of the last two sensors 
has failed. In the ACT Primary Computer, this would result in choosing a default value. 
Selecting a default value for the pitch-rate signal, which is the only control variable 
processed by the Essential PAS Computer, would result in potential loss of the short- 
period PAS function and, given the ground rules of this study, loss of the aircraft. The 
best-value select software applies reasonableness tests and checks the results of sensor 
self -tests to determine which signal is correct. If no probable best value is indicated, one 
of the signals is arbitrarily selected. 

Fixed-gain short-period PAS software is similar to that of the ACT Primary Computer. 
The Essential PAS foreground tasks software includes an additional module, the Full PAS 
command selection (fig. 72). This software selects the output signal to be sent to the 
elevator from the Full PAS commands received from the ACT Primary Computers and the 
command calculated by the fixed-gain short-period PAS software. Because each Essential 
PAS Computer receives data on only one bus from the ACT Primary Computers, these 
data must be transferred cross channel before any voting may take place. The Essential 
PAS Computers have no autonomous I/O controller; hence, the transfer must be done by 
the CPU. Transfer data cross-channel software performs this task. These data are then 
checked by the comparison monitor software to detect failures in the ACT Primary 
Computers or in the data link. The reconfigure software examines the results of this 
comparison along with status outputs from the ACT Primary Computers to determine 
validity of these data. The select output signal software selects a signal from the valid 
outputs. If all three redundant signals from the ACT Primary Computers are good, the 
median select software determines the median signal for use as the output. If only two 
signals are valid, the average software selects the mean of those two signals. If less than 
two valid signals are available, the fixed-gain output software selects the output. Three 
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separate signals are transmitted over the bus from the ACT Primary Computers, one for a 
variable-gain short-period PAS, one for speed PAS, and one for the pitch compensation 
component of MLC. If either of the latter two fails, the fixed-gain output software 
selects zero for that part of the output. If the short-period PAS signal from the ACT 
Primary Computers fails, the fixed-gain output software selects the output calculated by 
the fixed-gain short-period PAS module of the Essential PAS Computers. The three parts 
of the elevator output are then summed. To prevent large step changes on the output, the 
fixed-gain output module includes easy-on software to smooth transients. 

The output monitor software functions the same as that of the ACT Primary Computers, 
except that it compares four outputs rather than three. The servomonitor software also 
functions similar to the ACT Primary Computer software, except it deals only with force- 
summed secondary servos and compares three servo spool valve positions and a 
mathematical model. 

Background tasks software (fig. 74) in the Essential PAS Computer is functionally 
identical to that of the ACT Primary Computer. Ground operations software (fig. 75) is 
also very similar to that of the ACT Primary Computer. The only significant differences 
occur in preflight test software (fig. 76), where the major sensor test module is deleted 
because the Essential PAS Computers do not receive data from the IRS or DADC. With 
cross strapping of pitch-rate sensor data, each computer communicates directly with each 
sensor and can isolate sensor failures by comparing results from the end-to-end tests. 

Computer self-test (fig. 77) software in the Essential PAS Computers is simplified from 
that of the ACT Primary Computers due to reduced complexity of the computers. The 
major simplification is deletion of wraparound testing. Cross strapping of sensor data and 
coordination of testing provide comparable fault detection with only slightly degraded 
fault isolation, and deleting wraparounds aids computer simplification. 

In addition to ACT Primary Computers and Essential PAS Computers, the system also 
requires an ACT Maintenance and Display Computer, which coordinates testing, provides 
fault information storage to aid maintenance personnel, and furnishes cockpit warning and 
advisory messages. This computer is not flight critical, and no effort has yet been made 
to detail software for it. 
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Figure 74. Essential Pitch-Augmented Stability Software, Background Tasks 
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Figure 75. Essential Pitch-Augmented Stability Software, Ground Operations 
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Figure 76. Essential Pitch-Augmented Stability Software, Preflight Test 














Figure 77. Essential Pitch -Augmented Stability Software, Computer Self-Test 


8.3.3 MEMORY AND EXECUTION TIME ASSESSMENT 


Based upon the software design described in Subsection 8.3.2, estimates of memory size 
and execution time have been made for major software modules. Table 13 summarizes 
these estimates. Wherever possible, estimates are based on laboratory test software 
written for the General Electric MCP-701A flight control computers, which represent 
performance typical of current-generation flight control computers. 


Total memory required for the ACT Primary Computers is approximately 15. IK words. 
Allowing for 50% growth yields a requirement for a minimum of 22K words. Execution 
time for the real-time functions is estimated to be 1^.8 ms in each 20-ms major frame. 
This allows a 34% margin for time growth. The growth margin may be inadequate if 
another machine with somewhat lower performance is considered. Even the 34% margin 
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Table 13. ACT Control System Memory Requirements and Timing 


Software module 

ACT Primary Computers 

Essential PAS Computers 

Memory, 

words 

Execution time 
(per major frame),ms 

Memory, 

words 

Execution time 
(per major frame), ms 

Real-time executive 

750 

0.2 

400 

0.2 

Foreground tasks 





Synchronization 

200 

0.6 

— 

— 

Scheduler 

100 

0.1 

— 

— 

SSFD 

800 

4.5 

325 

2.3 

Control laws 

1 200 

2.4 

100 

0.1 

Output monitor 

400 

2.5 

100 

0.3 

Servomonitor 

500 

4.5 

200 

0.5 

Background tasks 





Control and display 

1 900 


300 


communication 





In-flight tests 

500 


300 


Maintenance support 

200 


100 


Ground operations 





Test executive 

1 200 


600 


Preflight tests 

6 000 


4500 


Maintenance test 

1 000 


400 


Total 

15 100 

14.9 

7325 

3.4 


available for time growth with the MCP-701A is considerably below the preferred margin 
of 100%. However, the software is estimated based on a full-feature aircraft with all 
possible functions and surfaces. This represents a worst case with respect to execution 
time. For an actual system, the number of functions and surfaces is expected to be 
fewer; therefore, less execution time is expected. With this in mind, the relatively small 
growth margin is deemed acceptable. Background task execution time is not critical, with 
all functions completed in less than 5 sec. 

The Essential PAS Computers require approximately 7325 words of memory, 1625 of 
' which are for programs necessary for safe flight of the aircraft. The rest are active only 
on the ground for preflight or maintenance testing. A 50% memory growth allowance 
results in a requirement for a minimum of IIK words. Execution time for real-time 
software is estimated to be 3.4 ms per 10-ms frame, based upon execution of laboratory 
test programs on the MCP-701A. The PAS backup computer is based on a 16-bit 
microprocessor and would take longer to execute the problem. The margin available 
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should be adequate even with the expected slower execution time. Timing of background 
tasks is not critical. 

The ACT Maintenance and Display Computer software has not been defined in detail. It is 
expected to require up to 32K words, which could be 8-bit words. Timing is not critical 
for this computer. 
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8A ACT SYSTEM OPERATION 


The Selected System was introduced in Subsection 6A and described more fully in 
Section 7.0. The basic plan of system operation is given in those sections. 

This subsection will first detail the operability of the Active Controls Technology (ACT) 
system. Subsection 5.3.2 contains a narrative description of airplane performance 
capability with complete loss of each active control function considered separately. 
Subsection 8.^.1 presents that data in tabular form and develops the effect upon airplane 
operability of various combinations of functions lost and functions whose loss could result 
from one additional line replaceable unit (LRU) failure. 

Subsections SA.2, 8.4.3, and 8.4.4, respectively, detail the means by which: 

• System and component failures are detected. 

• Failure and system status information is communicated to flight and ground crews. 

• Flight plan change advisory messages are selected and communicated to the flight 
crew. 

8.4.1 AIRPLANE DISPATCHABILITY AND IN-FLIGHT OPERABILITY 

The effect of single function loss in the ACT system is described in Subsection 5.3.2 and 
reproduced in Table 14. Based on that airplane operability with a single function loss, a 
study was conducted to define operability with multiple ACT function failures. The 
results are shown in Table 15. The following list contains the assumptions made for the 
operability assessment shown in Table 15. 

• Only those functions listed in the table are assumed to be failed completely; i.e., 
other functions are assumed to be operating normally. 

• The table does not treat the period of transition from normal to restricted flight. 
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Table 14. (Assumed) ACT Airplane Operability and DispatchabUity 
With a Single Function (Complete) Loss 


Case 

No. 

Complete function loss 

In-flight operability 

Oispatchability 

Remarks 

1 

Short-period pitch- 
augmented stability 
(PAS) 

Loss of airplane 

No go 

PAS consists of crucial and critical PAS. 
The crucial PAS loss will cause an im- 
mediate safety hazard. 

2 

Speed PAS 

Flight restriction A 

Restricted flight 

Flying quality after the critical PAS 
loss is assumed to be acceptable for the 
restricted flight. 

3 

Angle of attack (AAL) 

Continue normal 
flight schedule 

No go 

The ACT airplane has "locked in" stall 
at low-speed condition. The airplane 
can continue normal flight schedule 
if the AAL failure (complete function 
loss) occurs in flight. The airplane may 
divert to other airport if severe turbu- 
lence exists at destination. No go 
is for safety reasons. 

4 

Lateral/directional- 
augmented stability 
(LAS) 

Flight restriction B 

No go 

Flying quality after the complete LAS 
loss is assumed to be acceptable for 
restricted flight. No go exists because 
of structure dispatch requirement. 

5 

Wing-load alleviation 
(WLA) 

Continue normal 
flight schedule 


The ACT airplane structure exceeds 
design limit load strength requirements 
without WLA system. 




No go 

The ACT airplane structure does not 
satisfy design ultimate load strength 
requirements without WLA. 

6 

Flutter-mode control 
(FMC) 

Flight restriction C 

Restricted 

flight 

The ACT airplane will retreat to a 
lower cruise speed to allow adequate 
speed margin for upset. 
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Table 15. (Assumed) ACT Airplane Operability and DispatchabiUty 
With Combination of Function Losses 



In-flight 

operability 

Dispatch- 

ability 

Remarks 

Flight 

restriction 

A 

No go 

Combination of cases 2 and 3 

Flight 

restriction 

D 

No go 

Combination of cases 2 and 4; assume 
flight restriction D exists 

Flight 

restriction 

A 

No go 

Combination of cases 2 and 5 

Flight 

restriction 

E 

Go with 

flight 

restriction 

Combination of cases 2 and 6; assume 
flight restriction E exists 

Flight 

restriction 

B 

No go 

Combination of cases 3 and 4 

Continue 

normal 

flight 

No go 

Combination of cases 3 and 5 

Flight 

restriction 

C 

No go 

Combination of cases 3 and 6 

Flight 

restriction 

B 

No go 

Combination of cases 4 and 5 

Flight 

restriction 

F 

No go 

Combination of cases 4 and 6; assume 
flight restriction F exists 

Flight 

restriction 

C 

No go 

Combination of cases 5 and 6 

Flight 

restriction 

D 

No go 

Combination of cases 2, 3, and 4 

Flight 

restriction 

A 

No go 

Combination of cases 2, 3, and 5 

Flight 

restriction 

E 

No go 

Combination of cases 2, 3, and 6 

Flight 

diversion 

No go 

Loss of critical PAS, LAS, and W LA may 
result in an unacceptable risk in handling, 
quality or performance capabilities under 
some abnormal conditions 

Flight 

restriction 

G 

No go 

Combination of cases, 2, 4, and 6 


X indicates function loss 
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Table 15. (Assumed) ACT Airplane Operability and DispatchabiUty 
With Combination of Function Losses (Continued) 


Case 

No. 

Crucial 

PAS 

Critical 

PAS 

AAL 

LAS 

WLA 

FMC 

In-flight 

operability 

Dispatch- 

ability 

Remarks 

22 


X 

■ 

■ 

X 

X 

Flight 

restriction 

E 

No go 

Combination of cases 2, 5, and 6 

23 



H 

H 

X 


Flight 

restriction 

B 

No go 

Combination of cases 3, 4, and 5 

24 



X 

X 


1 

Flight 

restriction 

F 

No go 

Combination of cases 3, 4, and 6 

25 



X 


X 

H 

Flight 

restriction 

c 

No go 

Combination of cases 3, 5, and 6 

26 




X 

X 

X 

Flight 

restriction 

F 

No go 

Combination of cases 4, 5, and 6 

27 


X 

X 

X 

X 


Flight 

diversion 

No go 

Flight diversion for the same reasons as 
case 20 

28 


X 

X 

X 


■ 

Flight 

restriction 

G 

No go 

AAL loss does not affect handling quality; 
same as case 21 

29 


X 

X 


1 

B 

Flight 

restriction 

E 

No go 

Loss of WLA and AAL does not affect 
handling quality; same as case 22 

30 


X 


X 


X 

Flight 

diversion 

No go 

Flight diversion for the same reason as 
case 20 

31 



X 

X 

D 

X 

Flight 

restriction 

F 

No go 

Loss of AAL and WLA does not affect 
handling quality; flight restriction for the 
same reason as case 26 

32 


X 

■ 

■ 

X 

■ 

Flight 

diversion 

No go 



Flight diversion for the same reason as 
cases 20, 27, and 30 


X indicates function loss 


• Flight restrictions A, B, C, D, E, F, or G indicate that some type of restriction 
exists for given system failures. Lacking detailed airplane performance 
characteristics, these restrictions cannot be specified. Experience indicates that 
when these restrictions can be determined, there will probably be not seven 
different restrictions but three or four. 


Based on the airplane operability in Tables 14 and 15, the ground rules were established as 
described in Subsections 8. 4. 1.1 and 8.4. 1.2 for prediction of in-flight operability and 
dispatchability of the ACT airplane. Results of these predictions are discussed in detail 
under Reliability Assessment in Subsections 9.2.2 and 9.2.3. 
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In-Flight Operability 


In-flight schedule changes include flight restriction and flight diversion. Flight restriction 
may force the pilot to change the flight envelope or alter normal operating procedures to 
avoid a potential safety hazard. In case of flight diversion, the pilot must land the 
airplane as soon as possible to avoid the hazard. In some cases, the pilot will initiate 
flight restriction with sufficient redundancy remaining prior to complete function loss. 
The following ground rules are established for assessment of schedule change reliability: 

• The pilot shall continue a normal flight schedule when angle-of-attack limiter (AAL) 
or wing-load alleviation (WLA) or both functions become inoperative in the air, 
assuming other ACT functions are operative with sufficient redundancy. 

• The pilot shall initiate a flight restriction when subsystem failures occur in such a 
way that one more LRU failure would result in the flight restriction in Table 15.- 

• The pilot shall initiate a flight diversion when subsystem failures occur in such a 
way that one more LRU failure would require flight diversion shown in Table 15. 

The last two "one more failure" stipulations make the operability tables much more 
complicated. Adding those statements to Table 15 yields Tables 16 and 17. 

8.<^.1.2 Dispatchability 

The following general rules govern the influence of the ACT control system on airplane 
dispatch. 

• No Go 


• The airplane shall not be dispatched, regardless of other function status, when 
the system has complete loss of one or a combination of AAL, 
lateral/directional-augmented stability (LAS), and WLA functions. 
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Table 16. . Dispatchability 


Case 

No. 

System failures®'*^ 

Dispatchability 


No go 

Go with 

flight restriction 

Go without 
flight restriction 

Remarks^ 

1 

Crucial PAS 

Crucial PAS(X)'^'® 

Not applicable 

Not applicable 

- 

B 

Critical PAS 

Not applicable 

Critical PAS(X or 0) 

Not applicable 

Flight restriction A 

H 

AAL 

AAL(X) 

Not applicable 

AAL(O) 


H 

LAS 

LAS(X) 

LAS(O) 

Not applicable 

Flight restriction B 

H 

WLA 

WLA(X) 

Not applicable 

WLA(O) 



EMC 

Not applicable 

FMC(X) 

FMC(O) 

Flight restriction C 

H 

Critical PAS, 
AAL 

AAL(X) and DC^ 

PAS(X or 0) and 
AAL(O) 

Not applicable 

Flight restriction A 

8 

Critical PAS, 
LAS 

LAS(X) and DC 

PAS(X or 0) and 
LAS(O) 

Not applicable 

Flight restriction D 

9 

! 

Critical PAS, 
WLA 

WLA(X) and DC 

PAS(X or 0) and 
WLA(O) 

Not applicable 

Flight restriction A 

10 

i 

Critical PAS, 
FMC 

Not applicable 

PAS(X or 0) and 
FMC(X) 

PAS(X or 0) and 
FMC(O) 

Not applicable 
Not applicable 

Flight restriction E 
Flight restriction A 

11 

AAL, LAS 

AAL(X) or LAS(X) 
and DC 

AAL(O) and LAS(O) 

Not applicable 

Flight restriction B 

12 

AAL, WLA 

AAL(X) orWLA(X) 
and DC 

Not applicable 

AAL(O) and WLA(O) 


13 

AAL, FMC 

AAL(X) and DC 

AAL(O) and FMC(X) 

AAL(O) and FMC(O) 

Flight restriction C 

14 

LAS, WLA 

LAS(X) or WLA(X) 

LAS(O) and WLA(O) 

Not applicable 

Flight restriction B 


®Only those functions shown in this column are assumed to be failed. (Other functions are operative with 
sufficient redundancy.) 

*^Single and combination of failures 
^Indicates type of flight restriction 

^No go if remaining crucial PAS has reliability lower than 10”® failure after 1 hr of flight 

®{X) indicates complete function loss 
(0) indicates one failure away .from complete function loss 
Example 1: LAS(X) = complete LAS loss 

LAS(O) = one failure away from complete LAS loss 
Example 2: LAS(X or 0) = LAS(X) or LAG(O) 

^DC indicates don't care 

Example: (Case 7) no go under AAL(X) and DC = no go if AAL is lost regardless of other functions 

(don't care other functions) 
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Table 16. Dispatchability (Continued) 


Case 

No. 

System failures^'*^ 


Dispatchability 


Remarks*' 

No go 

Go with 

flight restriction 

Go without 
flight restriction 

15 

LAS, FMC 

LAS{X) and DC 

LAS(O) and FMC(X) 
LAS(O) and FMC(O) 

Not applicable 
Not applicable 

Flight restriction F 
Flight restriction B 

16 

WLA, FMC 

WLA(X) and DC 

WLA(O) and FMC(X) 

WLAIO) and FMCIO) 

Flight restriction C 

17 

Critical PAS, 
AAL, LAS 

AAL(X) or LAS(X) 
and DC 

PAS(X or 0) and 
LAS(O) and AAL(O) 

Not applicable 

Flight restriction D 

18 

Critical PAS, 
AAL, WLA 

AAL(X) orWLA(X) 
and DC 

PASIX or 0) and 
WLA(O) andAAL(O) 

Not applicable 

Flight restriction A 

19 

Critical PAS, 
AAL, FMC 

AAL(X) and DC 

PASIX or 0) and 
AALIO) or FMCIX) 
PASIX or 0) and 
AALIO) or FMCIO) 

Not applicable 
Not applicable 

Flight restriction E 
Flight restriction A 

20 

Critical PAS, 
LAS, WLA 

(PAS-LAS WLA) (0) 
or LAS(X) or 
WLA(X) 

Not applicable 

Not applicable 

- 

21 

Critical PAS, 
LAS, FMC 

LAS(X) and DC 

PASIX or 0) and 
LASIO) and FMC|X) 
PASIX or 0) and 
LASIO) and FMCIO) 

Not applicable 
Not applicable 

Flight restriction G 
Flight restriction D 

22 

Critical PAS, 
WLA, FMC 

WLA(X) and DC 

PASIX or 0) and 
WLA 10) and FMCIX) 
PASIX or 0) and 
WLAIO) and FMCIO) 

Not applicable 
Not applicable 

Flight restriction E 
Flight restriction A 

23 

AAL, LAS, WLA 

AAL(X) or LAS(X) 
or WLA(X) and DC 

AALIO) and LASIO) 
and WLAIO) 

Not applicable 

Flight restriction B 

24 

AAL, LAS, FMC 

AAL(X) or LASIX) 
and DC 

AALIO) AND LASIO) 
and FMCIX) 

AALIO) and LASIO) 
and FMCIO) 

Not applicable 
Not applicable 

Flight restriction F 
Flight restriction B 

25 

AAL, WLA, FMC 

AAL(X) orWLA(X) 
and DC 

AALIO) and WLAIO) 
and FMCIX) 

AALIO) and WLAIO) 
and FMCIO) 

Flight restriction C 

26 

LAS, WLA, FMC 

LAS(X) orWLA(X) 
and DC 

LASIO) and WLAIO) 
and FMCIX) 

LASIO) and WLAIO) 
and FMCIO) 

Not applicable 
Not applicable 

Flight restriction F 
Flight restriction B 

27 

Critical PAS, 
AAL, LAS, WLA 

(PAS-1.AS WLA) (0) 
or LAS(X) or 
WLA(X) 
and DC-AAL 

Not applicable 

Not applicable 





203 









Table 16. 'Dispatchability (Concluded) 


Case 

No. 

System failures®'*’ 

Dispatchability 


No go 

Go with 

flight restriction 

Go without 
flight restriction 

Remarks® 

28 

Critical PAS, 
AAL, LAS.FMC 

AAL(X) or LASIX) 
and DC 

PASIX or 0) and 
AALIO) and LASIO) 
and FMC(X) 

Not applicable 

Flight restriction G 




PASIX or 0) and 
AALIO) and LASIO) 
and FMC(O) 

Not applicable 

Flight restriction D 

29 

Critical PAS, 
AAL, WLA, FMC 

AAL(X) or WLA(X) 
and DC 

PASIX or 0) and 
AALIO) and WLA 10) 
and FMC(X) 

Not applicable 

Flight restriction E 




PASIX or 0) and 
AALIO) andWLAIO) 
and FMCIO) 

Not applicable 

Flight restriction A 

30 

Critical PAS, 
LAS, WLA, 
FMC 

PASIX or 0) and 
LASIX or 0) and 
WLAIX or 0) and 
DC- AAL 

Not applicable 

Not applicable 


31 

AAL, LAS, 
WLA, FMC 

AALIX) or LASIX) 
or WLAIX) and DC- 
FMC 

AAL (0) and LASIO) 
andWLAIO) and 
FMCIX) 

Not applicable 

Flight restriction F 




AALIO) and LASIO) 
and WLA 10) and 
FMCIO) 

Not applicable 

Flight restriction B 

32 

Critical PAS, 
AAL, LAS, 
WLA, FMC 

PASIX or 0) and LAS 
IX or 0) and WLAIX 
or 0) and DC-FMC 
and DC-AAL 

Not applicable 

Not applicable 



• The airplane shall not be dispatched, regardless of other function status, when 

subsystem failures occur in such a way that the crucial pitch-augmented 

-9 

stability (PAS) function does not meet the reliability requirement of 10” 
failure probability per 1-hr flight. 

• Go With Flight Restriction 


The airplane shall be dispatchable with a flight restriction when subsystem failure 
results in one of the following failure combinations: 

• Loss of critical PAS function 

• One failure from complete critical PAS loss 

• One failure from complete LAS loss 

• Loss of flutter-mode control (FMC) function 
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Table 17. : In-Flight Operability 



0 b 

System failures ' 

Flight diversion 

Flight restriction 

Continuation of normal 
flight schedule 

Remarks^ 

1 

2 

Crucial PAS 
Critical PAS 

PAS(Q)'^ 

Not applicable 

Not applicable 
Critical PAS{X or 0) 

Other crucial PAS failures 
Not applicable 

Complete loss of 
crucial PAS 
will lose aircraft 
Flight restriction A 

3 

AAL 

Not applicable 

Not applicable 

AAL (X or 0) 


4 

LAS 

Not applicable 

LAS(X or 0) 

Not applicable 

Flight restriction B 

5 

WLA 

Not applicable 

Not applicable 

WLA(X or 0) 


6 

FMC 

Not applicable 

FMC(X) 

FMC(O) 

Flight restriction C 

7 

Critical PAS, AAL 

Not applicable 

PAS(XorO) and 
DC-AAL» 

Not applicable 

Flight restriction A 

8 

Critical PAS, LAS 

Not applicable 

PAS(X or 0) and 
LAS(X or 0) 

Not applicable 

Flight restriction D 

9 

Critical PAS, WLA 

Not aoplicable 

PAS(X or 0) and 
DC-WLA 

Not applicable 

Flight restriction A 

10 

Critical PAS, FMC 

Not applicable 

PAS(X or 0) and 
FMC(X) 

PAS(X or 0) and 
FMC(O) 

Not applicable 
Not applicable 

Flight restriction E 
Flight restriction A 

11 

AAL, LAS 

Not applicable 

LAS(X or 0) and 
DC-AAL 

Not applicable 

Flight restriction B 

12 

AAL, WLA 

Not applicable 

Not applicable 

AAL(X or 0) and WLA 
(X orO) 


13 

AAL, FMC 

Not applicable 

FMC(X) and DC-AAL 

FMC(O) and DC-AAL 

Flight restriction C 

14 

LAS, WLA 

Not applicable 

LAS(X or 0) and 
DC-WLA 

Not applicable 

Flight restriction B 


®Only those functions shown in this column are assumed to be failed. 

(Other functions are operative with sufficient redundancy.) 

^ Single and combination of failures 
Indicates type of flight restriction 
° (X) indicates complete function loss 
(0) indicates one failure away from complete function loss 
Example 1 : LAS(X) = complete LAS loss 

LAS(b) = one LRU failure away from complete LAS loss 
Example 2: LAS(X or 0) = LAS(X) or LAS(O) 

® DC indicates don't care 


Example: (Case 7) No go under AAL (X) and DC = No go if AAL is lost regardless of other functions 
(don't care other functions) 
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Table 17. In-Flight Operability (Continued) 


Case 

3 b 

System failures ' 

Flight diversion 

Flight restriction 

Continuation of 


No. 

normal flight schedule 

Remarks 

15 

LAS, FMC 

Not applicable 

LAS(X or 0) and 
FMC(X) 

Not applicable 

Flight restriction F 




LAS{X or 0) and 
FMC(O) 

Not applicable 

Flight restriction B 

16 

WLA, FMC 

Not applicable 

FMC(X) and DC-WLA 

FMC(O) and DC-WLA 

Flight restriction C 

17 

Critical PAS, AAL, 

Not applicable 

PAS(XorO) and 

Not applicable 

Flight restriction D 


LAS 


LAS{X or 0) and 
DC-AAL 



18 

Critical PAS, AAL, 

Not applicable 

PAS(X or 0), and 

Not applicable 

Flight restriction A 


WLA 


DC-AAL and DC-WLA 



19 

Critical PAS, AAL, 

Not applicable 

PASIX orO) and 

Not applicable 

Flight restriction E 


FMC 


FMC{X) and DC-AAL 
PAS(X or 0) and 
FMC(O) and DC-AAL 

Not applicable 

Flight restriction A 

20 

Critical PAS, LAS, 

(PASLASWLA) 

Not applicable 

Not applicable 



WLA 

(X or 0) 




21 

Critical PAS, LAS, 

Not applicable 

PAS(X or 0) and 

Not applicable 

Flight restriction G 


FMC 


LAS(X or 0) and 
FMC(X) 

PAS(X or 0) and 
LAS(X or 0) and 
FMC(O) 

Not applicable 

Flight restriction D 

22 

Critical PAS, WLA, 

Not applicable 

PAS(X or 0) and 

Not applicable 

Flight restriction E 


FMC 


DC-WLA and FMC(X) 
PAS{X or 0) and 
DC-WLA and FMC(O) 

Not applicable 

Flight restriction A 

23 

AAL, LAS, WLA 

Not applicable 

LAS(X or 0) and 
DC-AAL and DC-WLA 

Not applicable 

Flight restriction B 

24 

AAL, LAS, FMC 

Not applicable 

LASIX or 0) and 
DC-AAL and FMC(X) 

Not applicable 

Flight restriction F 




LAS(X or 0) and 
DC-AAL and FMC(O) 

Not applicable 

Flight restriction B 

25 

AAL, WLA, FMC 

Not applicable 

FMC(X) and DC-AAL 

FMC(O) and DC-AAL 

Flight restriction C 




and DC-WLA 

and DC-WLA 


26 

LAS, WLA, FMC 

Not aoplicable 

LAS(X or 0) and 
DC-WLA and FMC(X) 

Not applicable 

Flight restriction F 





LAS(X or 0) and 
DC-WLA and FMC(O) 

Not applicable 

Flight restriction B 
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Table 17. In-Flight Operability (Concluded) 


Case 

No. 

System failures^'^ 

Flight diversion 

Flight restriction 

Continuation of 
normal flight schedule 

Remarks'' 

27 

Critical PAS, AAL, 
LAS, WLA 

(PAS-LAS-WLA) 
jx or 0) and 
DC-AAL 

Not applicable 

Not applicable 


28 

Critical PAS, AAL, 
LAS, FMC 1 

Not applicable 

PAS(X or 0) and 
DC-AAL and LAS(X,or 0) 
and FMC(X) and 
PAS(X or 0) and 
DC-AAL and 
LAS(X or 0) and FMC(O) 

Not applicable 
Not applicable 

Flight restriction G 
Flight restriction D 

29 

Critical PAS, AAL, 
WLA, FMC 

Not applicable 

PAS(X or 0) and 
DC-AAL and DC-WLA 
and FMC(X) and 
PAS(X or 0) and 
DC-AAL and DC-WLA 
'andFMC(d) 

Not applicable 
Not applicable 

Flight restriction E 
Flight restriction A 

30 

Critical PAS, LAS, 
WLA, FMC 

(PAS-LAS-WLA) 
(X or 0) and 
DC-FMC 

Not applicable 

Not applicable 


31 

AAL, LAS, WLA, 
FMC 

Not applicable 

LAS(X or 0) and 
FMC(X) and DC-AAL 
and DC-WLA 
LAS(X or 0) and 
FMC(O) and DC-AAL 
and DC-WLA 

Not applicable 
Not applicable 

Flight restriction F 
Flight restriction B 

32 

Critical PAS, AAL, 
LAS, WLA, FMC 

(PAS-LAS-WLA) 
(X or 0) and 
DC-FMCand 
DC-AAL 

Not applicable 

Not applicable 



• Go With No Flight Restriction 


The airplane shall be dispatchable without any restriction when subsystem failures 
occur in such a way that one more failure would result in loss of FMC function. 

Again, inclusion of the "one failure from" statements expands Table 15 to the much more 
inclusive Table 17 form. 
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8.4.2 SYSTEM TEST AND MAINTENANCE 


Figure 78 shows the organization of ACT testing in three modes. Although routine 
preflight testing is undesirable, the system criticality described in Subsection 5.3.1 makes 
preflight essential, and the primarily electronic character of the system, coupled with 
computer automation, combines to make preflight test time very short. These tests are 
indicated in the second column at the left in Figure 78. The same tests and others can be 
called up as needed for maintenance operations represented at the right in the figure. In 
the lAAC ground test concept, all of these tests are accomplished without special test 
equipment; the active control computers do the whole job. 

The ACT Primary Computers have sufficient capacity such that they can perform 
multiple control law and redundancy management calculations during flight and also 
monitor their own soundness and that of the system as well. The in-flight monitor mode is 
indicated in the middle of Figure 78. 

The computer memory required for system test is presently estimated at 8200 words in 
the ACT Primary Computer and 5500 words in the Essential PAS Computer. Figure 79 
shows the logic fundamental to the selection of test and maintenance modes and the basic 
control character of each mode. One of the large blocks will be detailed in a later figure. 

Figure 80 is a bar chart that compares time available to time required for routine ACT 
testing. The ACT Design Requirements and Objectives Document states the objective 
that "preflight test time shall be less than 2 minutes." ACT Primary and Essential PAS 
Computer sets will test themselves simultaneously; the ACT Primary self-test series is 
slightly longer than the Essential PAS, both remaining below 30 sec by current estimate. 

The electronic preflight will be performed simultaneously with other cockpit preparation 
operations typically needing 10 min or more. The mechanical part of preflight must 
exercise the ACT servos. This requires operating pressure in the hydraulic system and 
means that either the main propulsion engines or the auxiliary power unit (APU) must be 
running. The servo test also results in control surface motions. These conditions 
prerequire that the aircraft have ground clearance for personnel safety reasons. Thus, 
this part of preflight will be done just before taxiing or during taxi out. At least in the 
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Figure 78. Test and Maintenance Overview 
























Figure 79. System Test Functional Flow 
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Figure 80. System Test Time Requirements 
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latter case, the duration of less than 0.5 min will not extend airplane preflight time. The 
last bar at the right in Figure 80 indicates the full-time character of the in-flight 
monitors. 

ZA.2.1 Preflight Testing 

The objectives of preflight testing are to: 

• Provide a factual basis for the part of the pilot's dispatch decision representing the 
ACT control system 

• Identify the failed LRUs if the ACT system indication is no go, and verify system 
integrity after replacement 

The first objective requires that the control system operating status be made known to 
the pilot. 

System faults determined during preflight test will have one of three results: 

• No effect upon the flight plan 

• Takeoff into a restricted flight plan 

• "No go," dispatch denied 

Fault information is presented to the flight crew only in the latter two cases. 
Subsection 8.4.^ details how the system and air crew respond to such cases. 

Figure 17 shows the organization of the ACT control system as a whole, including the 
provisions for all six active control functions. Figure 81 is an idealized form of the prior 
diagram and will be used to illustrate the preflight test series. Each computer set 
performs the same test and monitor functions again with respect to its own input and 
output quantities. The one exception is the singular interface between the two computer 
sets; this must be treated as a special case. 

Although the ACT Maintenance and Display Computer is not dispatch required, it can be 
undergoing test during the ACT preflight test period simultaneously with the two control 
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computer sets. This saves time and allows the crew to know before takeoff the 
availability of the "automatic option" information output illustrated at 2 in Figure 41. 

Preflight Test— Electronic— The basic scheme of the preflight test series is the "inside-out" 
plan, in which the computers first test themselves and then, employing their recently 
verified hardware and software, test the operation of other components and combinations. 
This sequence is illustrated in Figure 82. In the first preflight test phase, the computers 
will perform the following self -tests under software control: 

• Program sum checks 

• Hardware monitor test 

• Digital receiver and transmitter test 

• Scratch pad memory read/write test 

• Discrete input/output test 

• Analog input/output test 

• Instruction repertoire 
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The Essential PAS Computers will not require all the tests of this list; e.g., discrete 
input/output is not needed in these computers. 

Next, the computers test the control system monitors as indicated at 2 in Figure 82. The 
three sets of cross-channel monitors are as follows; 

• Signal selection and failure detection (SSFD) is the sensor comparison monitor. It 
selects a midvalue from among the sensor signals gathered by cross-channel 
communication and then derives and tests differences to detect sensor failure. 
Selected midvalues are input to the computer control law process. 

• The computer output monitor compares the results of the multiple parallel control 
law computations that are performed based upon the one selected sensor signal. 
Differences detected there indicate faulty computer operation. 
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• The servomonitor is a computer operating on signals fed back from active control 
servos to the computer. In the redundant secondary servos, the second-stage valve 
spool position is sensed by a linear variable differential transformer (LVDT); after 
being digitized, these signals and the mathematical models of spool position are 
compared to enable detection of servo faults. 

These monitors, illustrated in Figure 53, are used in flight operations as full-time 
overseers of system operation and detectors of local faults. They also serve the same 
functions in ground test phases; hence their proper operation must be verified early in the 
ground test sequence. 

The foregoing tests will be run separately but simultaneously by the ACT Primary and 
Essential PAS Computers. 

The "special case" cited early in this subsection is the test of the decision process in 
which the short-period pitch augmentation responsibility is transferred from the ACT 
Primary Computers to the Essential PAS Computers. As part of its software, the latter 
computer set has a continuous monitor function on the elevator command output of the 
primary computers. This midvalue logic cross-channel monitor must be tested using both 
computer sets; therefore, this test occurs at the end of the control system monitor 
testing. 

Next, as indicated at 3 in Figure 82, the primary computers call for reports on the 
soundness of the two major sensor sets: the digital air data computers (DADC) and the 
inertial reference systems (IRS). Of the six active control functions, five are served by 
the DADCs and four by the IRSs. Thus, those two sets are the most complex and widely 
used sensors. Both have their own digital computers and their own self-test routines. In 
the preflight test, the ACT Primary Computers will call upon the DADCs and the IRSs to 
report individually upon their availability for service in the upcoming flight. 

To complete the electronic preflight test, the ACT Primary and Essential PAS Computers 
perform an end-to-end electronic exercise of the various functions without actuator 
operation. This is shown at 4 in Figure 82 and at B in Figure 83. The airplane presumably 
still lacks ground clearance and hydraulic power; hence, there will be no actuator 
response. However, the servocommand output is still available for comparison with stored 
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(Signal not available 



End-to-end test, electronic 


Figure 83. ACT Function Loop Tests 


reference values. For the control laws for low-frequency ACT functions, a static output 
represents an adequate test criterion. For high-frequency mode control laws, the dynamic 
response must be observed to check for proper damping. This requires much greater test 
data and sampling rate than the static output case. 

In operation, the test program injects a sensor stimulus to cause a sensor output that will 
be processed in the control law computation to yield a servocommand. An out-of- 
tolerance response by itself would indicate only a fault somewhere in the loop represented 
in the sketch. The fact that (1) three or four such loops are being run simultaneously and 
(2) that cross-channel comparisons are being done at SSFD and computer output monitors 
enable the test system to identify the faulty LRU, excepting, of course, the servo. 
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Preflight Test-Mechanical- This final part of the prefiight routine, shown at A in 
Figure 83, tests the servoactuators. It requires hydraulic power and ground clearance; 
hence, it is normally performed during taxi out from loading gate to takeoff runway. 
Requiring confirmation of mechanical motions, these tests are much slower than the 
electronic steps. Therefore, they are performed in parallel, with computer commands 
synchronized to each servo. Entirely satisfactory servo response testing can be achieved 
using small excursion commands such as 20% of full-scale deflection. Using such 
commands limits the hydraulic power demand such that all ACT servos can be tested 
simultaneously as long as both engine-driven hydraulic pumps are operating. 

The servomonitor and the ability to deactivate failed channels (functions illustrated in 
fig. 53) are also checked in the mechanical test phase. 

&A.2.2 In-Flight Monitors 

ACT control system in-flight monitoring has these important objectives: 

• Continuously check on system operations 

• Detect and report failures 

• Reconfigure the failure-affected function control chains to minimize redundancy 
loss 

The in-flight monitors are shown in block diagram form in Figure 53. The monitor 
functional flow is illustrated in Figure 84, which, as shown in the small key diagram at the 
right, is a part of Figure 79. Figure 41 illustrates system response to in-flight faults as 
detected by the monitor network, the same as the preflight fault response activity. 

As illustrated in Figure 78, at the moment of ACT airplane lift-off, the condition of "no 
weight on wheels" signals the start of ACT system operation and the beginning of routine 
in-flight monitor operations in the computer background mode. In the operating 
condition, the computer watchdog and overflow monitors operate continuously to guard 
against timing errors and overflow. Parity and sum checks are also cyclically performed. 
These are sources of information on the soundness of the operating computers. 
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(Ref fig. 79) 
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Figure 84. In-Flight Monitor Functional Flow 










In this phase, sensors and servos cannot safely be given artificial stimuli. The major 
sensors, DADC and IRS, are within their computers performing continuous self-test and 
reporting their soundness via "status monitor" bits in each data word transmitted. This 
comes from inline testing and can be relied on for about 90% fault detection. Thus, 
continuous operation of ACT cross-channel monitors in flight is essential if the system is 
to achieve very high failure detection probability. 

Information on an in-flight fault that would prevent next dispatch will be displayed to 
enable call ahead for maintenance action at the next stop. All fault information also is 
retained in the ACT Maintenance and Display Computer memory and maintained there 
for several flights in chronological order. 

SA.2.3 Maintenance Testing 

The maintenance test plan for the active control system is based upon these concepts: 

• Fault information for several flights is immediately available to the maintenance 
technician via the ACT Maintenance and Display Computer. 

• Individual component and subsystem tests are run automatically under control of the 
ACT computers. 

• Selection of tests is accomplished by the technician via the ACT Maintenance and 
Display Computer. 

All tests of the preflight series are available individually for maintenance use. Those 
involving the DADC and the IRS require advance power up of those systems. In addition, 
the maintenance test spectrum includes individual sensor and servo tests and full end-to- 
end tests, as shown at A in Figure 83. In these, the computer test program sends an 
appropriate stimulus to the sensor or servo and compares the returned signal with its 
stored range of acceptable values. 

Any of these tests is callable at will by the technician to enable (1) verifying stored fault 
data, (2) diagnosing failed functions, and (3) checking results of maintenance action. 
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iA.3 CREW COMMUNICATION 


The communication requirements of the active control system, both from system to crew 
and from crew to system, are described in terms of system operation; i.e., what is 
required of the crew to monitor and manage the ACT system in its almost entirely 
automatic operation. 

8.^.3.1 Preflight Testing 

Preflight testing required of the active control system occurs in two automatic sequences: 
electronic preflight and mechanical preflight. Although both test sequences proceed 
without crew intervention, the crew must select the time they are performed. Thus, 
there must be a "start test" switch for each of these two operations. These momentary 
contact pushbutton switches will be illuminated as they are pushed and the test begins. 
The light behind the button will be extinguished at completion of the test sequence. 

The preceding information describes crew requirements for a normal preflight test in 
which no fault is found. Where faults are found, the communication requirement is not as 
simple. The system recognizes and stores information on faults of three levels: 

• Faults that have no effect upon aircraft dispatchability 

O Faults that allow dispatch but with some restriction to the flight plan 

• Faults that prevent dispatch 

Figure ^1 illustrates response to faults detected in preflight test. 

The first category of fault is not reported to the flight crew. If a fault found in preflight 
test affects dispatchability of the airplane, it is next necessary to determine the status of 
the ACT function or functions affected by the failure and display that status for the flight 
crew. At this point, the crew has the option of referring to an operations manual to 
determine the flight plan effect specified for the particular status. Alternatively, the 
crew can use the same information, determined as a flight advisory message by the active 
control system and displayed subsequent to the function status message. The pilot's 
decision may be made based upon the same information derived either way, from the 
manual or from the information display- 
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The operations are illustrated in Figure 41. System operations are shown at the top of the 
figure, and the pilot actions are represented in the lower portion. Communication from 
the control system to the crew shows in that diagram at two places indicated by the 
circled numbers 1 and 2. Function status is reported by the dedicated ACT discrete 
display; the operations advisory message is shown by the baseline caution and warning 
system caution annunciator display. The block diagram in Figure 40 illustrates this 
scheme. The two sets of active control computers determine function status as indicated 
in the top line in Figure 41 and then relay that information to the ACT Maintenance and 
Display Computer. This computer selects the corresponding flight advisory message, if 
any is required, and passes it to the caution annunciator display. 

The preceding constitutes the primary mode of operation of system communications in the 
preflight test process. Only one ACT Maintenance and Display Computer is included in 
the system, and it is not required for dispatch. Therefore, there must be a backup 
communication alternative to determine dispatch information about the control system 
itself if the ACT Maintenance and Display Computer is not available. The provision for 
that is a set of dedicated active control system indicator lights, capable of displaying 
function status as represented at circled number 1 in Figure 41. Those indicators, 
combined with the operations manual, enable the dispatch decision to be made whether or 
not the caution annunciator display Is showing information from the ACT Maintenance and 
Display Computer. 

The only additional crew communication provisions required are the active control 
function disconnect switches. These switches are accompanied by reconnect switches to 
accommodate possible erroneous disconnect. 

All crew communication provisions represented in the foregoing discussion are shown in 
Figure 85 and are intended to illustrate requirements rather than design selection. The 
concept represented there is based upon these assumptions: 

a. Fail-operative communication from the ACT system to the flight crew can be 
achieved by using the baseline caution and warning system plus dedicated discrete 
indicators showing the status of all ACT functions. 
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Function 

Indicators^ 

Switches (momentary 
contact, illuminated) 

Remarks 

Manual 

Active ' 
control 


Start preflight, electronic 



Switch illuminated during test.off at end 

Start prefiight, mechanical 


Mechanical 

See(^ above 

PAS short 

Red 

Divert 


Requires immediate diversion, 
function IS never disconnected 

PAS SPEED 







(§) Switch pushed to disable function 
remams illuminated as long as function 
IS disconnected 


Marg 


Inop 

Amber 


LAS 



Amber 

Inop 

Amber 

a 


See(^above 

WLA 

Marg White 

Inop 

Amber 


© 0 

See(^bove 

FMC 


Inop 

Amber 

0 0 


Stall warning and AAL 


Inop 

Amber 


See(^above 
See© above 

Notes ( 

c 

Failure information 
display 

\) If flaperons are required, 
^ Marg « one failure away 
h Disconnect switches (five 
^Signaled by PAS SHORT 

Master 

indicator 

Warning 

Red 

Amber 

(Alphanumeric 
color CRT. 

1 1 lines, 

16 characters/line) 

Caution 

annunciator 

display 

1 Pilot's main panel 

2 Flight engineer's 
panel 

Annunciators and master indicators are 
parts of baseline caution and warning 
system 

Annunciator will display 
(1) Failed dispatch-required LRU 
(2| Operations advisory messages 

ns 

Caution 


Each end of 
glare shield 


flaperon position indication must 
rom function loss Inop^functio 
) allow manual disconnect of indi 
tost or combination of PAS SPE£ 


Cancel „p'BRT'y^ Recall 

o ® o o 

be provided 

n inoperative, auto or manual disconnect 

/idual functions "On" switches enable reconnecting functic 

□ , LAS. and WLA lost 


Figure 85. ACT Cockpit Controls and Displays Requirements 


b. In the primary operating mode, the caution annunciator display will report all 
system information essential to the flight crew. This includes: 

• Identification of LRU failures if they are required for dispatch 

• Any change in flight plan made necessary by system failures 

c. In the backup mode for the loss of the caution annunciator panel, the crew will use 
the dedicated discrete status indicators. Flight manual data will be provided to 
interpret those indicators in terms of required operations changes. 

d. Manual controls will be provided only for: 

• Initiating preflight tests 

• Emergency disconnect 


221 


































In normal operation, system failures are followed by automatic reconfiguration or 
automatic function disconnect. 

e. Information displayed by the caution annunciator will be supplied by the ACT 
Maintenance and Display Computer. Backup discrete displays, both ACT dedicated 
and caution and warning system discrete indicators, will be signaled directly from 
the ACT control computers. 

f. Level A warnings (requiring immediate action) and level B cautions (crew attention 
and future action required) issued from the ACT system will activate the pilots' 
master lights on the glare shield. 

g. Dedicated ACT indicators and controls will appear on a dedicated ACT panel. 

In Figure 85, under the heading "Function," are the two "start test" operations needed for 
preflight test and the six active control functions. These individual items require the 
discrete indicators and controls appearing in the next two columns. Everything above the 
double line is there specifically for the associated functions. Below the double line is the 
baseline caution and warning system, which shows the items listed under assumption b. 
This system also provides crew communication for other onboard systems. 

The logic of assumption b is that different kinds of failures in the ACT control system 
have widely varying consequences. They may: 

• Have no effect upon operations 

• Have no effect upon flight in progress, but prevent dispatch 

• Require change in current flight plan 

For the first failure category, no information is needed by the crew. When the second 
category is encountered in flight, corrective maintenance must be done at the next way 
station. This will often require active preparation before the airplane lands, to the extent 
of flying in parts from another base. Such a situation would need the maintenance call- 
ahead function by the flight crew, and for that, identification of the failed component 
must be announced. For the last case, the crew must be notified of the flight plan 
change. 
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ZA.3.2 In-Flight Monitors 


Operation of the active control system in-flight monitor and self-test functions is 
completely automatic. The response of the system and flight crew to faults that these 
monitors discern in flight is again illustrated in Figure 41 and is almost entirely parallel to 
the system test and communication operations of the preflight period. The three response 
levels to faults required of the system and crew are as follows: 

• For a fault that does not affect flight operations, the system merely stores the 
component fault data; no notification is provided to the flight crew. 

• A system fault that does not affect current flight operation but will prevent the 
next dispatch must be identified so that the crew can arrange corrective 
maintenance at the next airport. 

• A fault that changes the function status so as to require a change in flight plan must 
be identified and the flight plan change announced to the crew. 

The responses just enumerated represent the normal mode of operation of the system 
when in-flight failures occur. Where the ACT Maintenance and Display Computer and 
caution and warning system chain is not operating, communication depends upon the set of 
discrete function status lights. Here again, as shown in Figure 41, the essential 
information is supplied by the discrete indicators and operations manual, enabling the 
pilot to determine proper response to the faults through the use of the manual. This dual 
display capability is shown in Figure 86, a more detailed version of Figure 40. 

A special case of in-flight change of plan is represented by the "Divert" indicator shown in 
Figure 85 in the short-period pitch-augmentation function line. The appearance of this 
red light, accompanied by the master warning lights on the glare shield and a warning 
aural signal, calls for immediate diversion of the flight to a landing at the nearest 
adequate runway. This emergency condition is produced either by reduction of the crucial 
pitch-augmentation function to only two success paths or by loss of the combination of 
three critical functions (speed PAS, LAS, and WLA), as defined in Tables 15 and 17. 


223 




224 


Figure 86. ACT Displays and Controls 









8AA FAULT RESPONSE 


The fault response function in the ACT control system uses failure information derived by 
the control computers to first determine the status of active control functions and then, 
from that information, to determine the correct change in operations, if any is required, 
and to communicate that to the pilots. This function must not be confused with the 
automatic response of the ACT computers to reconfigure active control functions after 
component failures. That operation is described in Subsection 8.2. 

The basic scheme in this fault response technique may be represented by the following 
sequence: 

Component ►Logic A ►Function ►Logic B — ►Advisory 

failure(s) status message 

Thus, when a component failure is detected in the active control system, it is entered into 
logic process A and the resulting output will be the operating status of the ACT function 
or functions affected. Similarly, that information injected into logic process B will result 
in output of the proper operations advisory message if any is needed. Logic A is 
implemented in the control computers, ACT Primary and Essential PAS; and logic B is 
implemented in the ACT Maintenance and Display Computer. This process is represented 
in Figure 41. There, where the control system determines function status, logic A is being 
applied; and, in the box labeled "Selects Flight Advisory Message," logic B is being 
implemented. As described in the preceding subsection, the ACT Maintenance and Display 
Computer is simplex equipment not required for dispatch; therefore, occasionally the ACT 
airplane will be operating without that computer. In that instance, logic A and the 
sequence indicated by the circled number one in Figure 41 apply, using the crew's 
reference to an operations manual. 

The simpler step shown in the preceding paragraph is logic B. This logic is expressed in 
the Boolean equations shown in version 1 of logic B, as listed in Table 18. Those equations 
are derived from the rules for dispatchability and operability of the ACT airplane as 
shown in Tables 15 and 16. Those tables, involved as they are, can be reduced to version 1 
of Table 18 with no assumption on the character of flight restrictions that might result 
from failure of various ACT functions and function combinations. Using a reasonable 
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Table 18. Selection of Advisory Messages From ACT Function Status 
(Logic B, Boolean Equations) 


Key: 


First letter 

Second letter 

P = f’AScpgprj 
A = AAL 
L = LAS 
W = WLA 
F = FMC 

L Function lost 

0 One failure away from function lost 

Exceptions: 

PS l^ASg|_|Q p-|- 

PSN PASgpQpjX>1 X 10'®/hr 
PSO PASgpQPj <three success paths 


Version 1 : No assumptions on character of flight restrictions 


Advisory message 

Conditions requiring message: 

At dispatch 

In flight 

Restriction A 

PL + PO 

PL + PO 

Restriction B 

LO 

LL + LO 

Restriction C 

FL 

FL 

Restriction D 

(PL + PO)-LO 

(PL + PO)*(LL + LO) 

Restriction E 

(PL + POl-FL 

(PL + PO)-FL 

Restriction F 

LO'FL 

(LL + LO)-FL 

Restriction G 

(PL + PO)-LO-FL 

(PL + PO)-(LL + LO)-FL 

NO GO 

PSN+AL + LL+WL + 

[(PL + PO)-(LL + LO)-(WL + WO)] 

DIVERT 


PSO+ [(PL + PO)-(LL + L0)-{WL+W011 


Version 2; Assuming flight restrictions.and function status scanned in 
this order: PS, A, W, L, P, F 


Advisory message 

Conditions requiring message: 

At dispatch 

In flight 

Restriction B 

LO 

LL+LO 

Restriction A (if B does not apply) 

PL + PO 

PL + PO 

Restriction C (if neither B nor A 



applies) 

FL 

FL 

Dispatch "NO GO" and in-flight "DIVERT" are the same as in version 1. 


configuration for the ACT airplane and assuming reasonable flight restrictions based upon 
current commercial jet transport practice, the number of flight restrictions applicable to 
these operations is reduced to only three plus the "Divert" command. With those 
additional assumptions, the Boolean equations for logic B reduce to the very simple form 
shown as version 2 in Table 18. Because the current technology control system work 
assumes no specific airplane configuration, version 2 does not represent a segment of the 
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selected ACT configuration description. It does, however, represent a probable 
simplification of the version 1 list of equations when they are actually applied to a real 
airframe. Such determination of an actual airframe and actual logic B equations will be 
done in ensuing stages of the lAAC Project. 

Logic A Boolean equations are less simple. They must accept the output of the entire 
fault determination process in both sets of active control computers operating on all 
components of the ACT system. With such a large number of elements as input items, the 
logic A equations become very long. One of the shorter equations, which determines 
flutter-mode control failure, has 60 terms in 15 variables. Including both function failure 
conditions and conditions where a function or a combination of functions is "one failure 
away from function loss," there must be 12 such logic A equations, some of them much 
larger than the sample described. Although these equations are subject to reduction 
techniques normal in Boolean algebraic operations, they will still require greater 
computer capacity than is needed for logic B. The derivation, reduction, and 
implementation planning for logic A equations will be subjects of the next phase of lAAC 
control system work. 
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8.5 HYDRAULIC SYSTEM 


8.5.1 BASELINE CONFIGURATION 


The general arrangement of the hydraulic power system is shown in Figure 87. The 
system is very similar to that of the Baseline Airplane. 


The Baseline hydraulic power generation system consists of three continuous-duty 20 700- 

■o 

kPa (3000-lbf/in ) systems that use phosphate ester fluid. The systems are identified as 
A, B, and C. In systems A and C, hydraulic power is generated by an engine-driven pump 
(EDP) installed parallel with an electric-motor-driven pump (EMP). System B hydraulic 
power is generated by two ac EMPs and one air-turbine-driven pump (ATDP). The bleed 



Leading-edge stats 
Nose-gear steering 
Wheel brakes 
Stabilizer trim 
Primary flight controls 
ACT 

Figure 87. Baseline Hydraulic Power System 
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air manifold serves as the pneumatic source. Emergency hydraulic power is derived from 
the wind-milling engines rotating the EDPs. System A is augmented by a ram-air-turbine- 
driven (RAT) hydraulic pump. Ground hydraulic power is available from the ATDP, 
powered by the auxiliary power unit (APU) or pneumatic ground cart; the ac pumps, also 
energized by ground cart or APU; or by an external hydraulic power supply source. Flight 
deck controls and displays consist of depressurization switches for the EDP, shutoff 
switches for the ATDP and the EMPs, low-pressure and low-fluid warning lights, and 
selectable readout for system pressure and fluid quantity. 

8.5.2 MODIFICATIONS FOR ACT CONFIGURATION 

The maximum additional hydraulic flow for each of the three ACT hydraulic systems is as 
follows; 

• 126-cm /s (2-GPM) (additional servovalves) leakage flow 

3 

O 126-cm /s (2-GPM) flow due to the higher rates for the ACT outboard ailerons 
(inboard and outboard segments) 

• 63 cm^/s (1 GPM) for secondary ACT actuators 

3 

• 126 cm /s (2 GPM) to drive outboard flaperons 

3 

• 315 cm /s (5 GPM) to drive inboard flaperons 

There is no difference in the hydraulic demand for the ACT versus Baseline yaw and pitch 
functions. 

A hydraulic flow load analysis indicates that, if the flaperons are excluded, all the other 
ACT functions can be accommodated by the Baseline system. When inboard and outboard 
flaperons are included in the ACT configuration, the 2334-cm /s (37-GPM) capacity of the 
three hydraulic pumps has to be increased by 20%, resulting in a total hydraulic system 
weight increase of approximately 4.5 kg (10 lb). 

The ACT technology base configuration hydraulic distribution system is shown in 
Figure 88. 
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Legend: 

EDP engine-driven pump 
EMP electric-motor (ac) driven pump 
ATDP air-turbine-driven pump 
RAT ram-air-turbine-driven pump 
NG nose gear 

MG mam gear 

ACT Active Controls Technology 
Hydraulic systems code: 

A hydraulic system A 
B hydraulic system B 
C hydraulic system C 


Figure 88. ACT Hydraulic System Distribution 


231 











8.6 ELECTRIC SYSTEM 


Redundant crucial and critical systems, such as the active controls system, require power 
sources with the same degree of redundancy to avoid losing more than one channel if a 
single power source fails. Furthermore, reliability of the power sources must be 
significantly better than the power utilization systems if the overall reliability is not to 
be compromised by the power sources. 

The electric system for the Baseline Airplane is discussed in Subsection 8.6.1; the 
modifications necessary for lAAC are described in Subsection 8.6.2. 

8.6.1 BASELINE CONFIGURATION 

8.6. 1.1 Primary Electric Power 

The Baseline and ACT electric systems are shown in Figure 89. Primary three-phase, 
115V, ^00-Hz power is supplied by two engine-driven 90-kVA integrated drive generators 
(IDG) that cannot be paralleled, so the system operates as two separate isolated channels. 
A third 90-kVA APU-driven generator is provided for ground maintenance operations and 
as an in-flight backup for the two main engine-driven generators. The APU can be started 
at any altitude up to 7620m (25 000 ft) and can provide full electric power up to 10 670m 
(35 000 ft). The APU generator control unit is interchangeable with those used for the 
engine-driven generators. Any single generator can supply all flight-essential loads. Two 
of the three generators must be operative for airplane dispatch with no load reduction or 
for a category III landing. 

During ground operations, electric power can be provided from either the APU generator 
or from a ground power cart through the 90-kVA external power receptacle. Ground 
power can be used to energize all main power buses or only those electric loads required 
for normal maintenance, servicing, and cargo handling. On the ground or in flight, utility 
and galley loads will be automatically shed when the system is overloaded. 

Airplane 28V dc power is provided by two 120A unregulated transformer-rectifier (T-R) 
units. Each of the two main ac buses supplies its own T-R unit. The dc system operates 
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Figure 89. ACT Airplane Electric Power System 

























isolated only. If a T-R unit fails, a dc bus tie contactor enables the remaining T-R unit to 
supply both main dc buses. During ground operation, a 20A T-R unit provides dc power for 
ground handling loads. 

A T-R unit is provided for normal starting of the APU when ac power is available from 
either the main generators or external power. When ac power is not available, a 
dedicated APU battery is used; a dedicated APU battery charger operates from either the 
main buses or external power. 

8.6.1. 2 Stcindby Electric Power 

Backup power to flight-critical loads is supplied by a 40-Ah nickel-cadmium battery and a 
1000-VA static inverter. A battery charger provides controlled recharge of the battery 
and operates as a T-R unit to supply the standby loads if the main dc source is lost but ac 
power is still available. Standby bus transfer is automatic. 

The third power source for the category III autoland system is provided by the standby 
system. During category III landing, third-channel autoland dc loads will be supplied by 
the standby battery charger in the T-R mode. Autoland ac loads will be supplied from the 
standby inverter. 

8.6.2 MODIFICATIONS FOR ACT CONFIGURATION 

The electric system for the ACT Configuration is shown in Figures 89 and 90. A second 
standby battery, with charger, with the same capacity as the Baseline Configuration 
standby battery is added to the Baseline electric system to provide the necessary 
redundancy to support the ACT system. The standby battery capacity requirement for the 
ACT airplane is approximately double that in the Baseline Airplane. Therefore, the 
additional standby battery has the same capacity as that in the Baseline Airplane. 
Battery 1 supplies channels A and B, and battery 2 supplies channels C and D. For 
dissimilar redundancy, no two buses share the same T-R and battery. Thus, ACT T-R 1 
supplies buses A and C, while T-R 2 supplies buses B and D (fig. 89). It is assumed that 
the Baseline Airplane standby battery load can be redistributed between the two ACT 
system battery buses to place about the same load on each battery. The individual T-R 1 
and battery loads are shown in Table 19. 
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Figure 90. Detail of ACT Channel Power Supply (Typical) 


Table 19. Individual Transformer-Rectifier and 
Battery Loads 


Power 

supply 

Channels 

Amperes 

ACT 

system 

Baseline 

Total 

T-R 1 

A and C 

39.3 

40.8 

80.1 

T-R 2 

B and D 

36.1 

43.5 

79.6 

Battery 1 

A and B 

39.0 

18.4 

57.4 

Battery 2 

C and D 

36.4 

22.9 

59.3 
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Assuming the total ACT system battery load and the Baseline standby loads all are 
supplied by the batteries for 30 min during emergency operation, the battery energy 
requirements are; 

• Battery 1 57 AA x 0.5 hr = 28.7 Ah 

• Battery 2 59. 3A x 0.5 hr = 29.7 Ah 

The Baseline Airplane standby and APU starting batteries are ^0-Ah units. To maintain 
commonality between standby and APU batteries, the same 40-Ah battery is 
recommended for the ACT airplane. 

The T-R capacity to supply the ACT system equipment is too small to justify additional 
dedicated T-Rs. The Baseline Airplane T-Rs, however, do not have growth potential to 
absorb the ACT system loads and still retain sufficient reserve capacity to supply all loads 
with one T-R inoperative. Therefore, the modification is to replace the baseline T-Rs 
with larger units (150 A) and supply the ACT system T-R buses from the main dc buses. In 
effect, the ACT system T-R buses are extensions of the main buses (fig. 89). 

The load totals for each power source are summarized in Table 20. Tables 21 and 22 list 
the ACT system dc and ac bus loads, respectively. Table 23 shows electric system 
equipment from Baseline specifications that satisfies ACT system needs. 


Tab/e 20. ACT Load Totals for Each Power Source 


T-Rs operating 

T-Rs not operating 

TRU 

Channel 

A 

Battery 

Channel 

A 

Ah* 

1 

A and C 

80.1 

1 

A and B 

57.4 

28.7 

CM 

B and D 

79.6 

2 

C and D 

59.3 

29.7 


30 min 
















Table 21. /ACT Direct-Current Bus Loads (Amperes) 


Load unit 

Current per unit 

Units per channel 

Current per channel 
Maximum steady state 

Comments 

Maximum 

steady 

state 

Maximum 

surge 

A 

B 

c 

D 

A 

B 

C 

D 

MCP-701 A computer 

3.6 


1 

1 

1 

B 

3.6 

3.6 

3.6 

B 


Control/display panel 

0.5 


1 

1 

1 

1 

B 

0.5 

0.5 

0.5 

One panel with 
four channels 

Elevator servo bypass 
solenoid 

0.6 

(hold) 

1.0 

(pull-in) 

B 

1 

1 

1 

B 

0.6 

0.6 

0.6 

Mathematical model 
in D channel 

Failure warning 
display 

0.1 


1 

1 

1 

1 

0.1 

0.1 

0.1 

0.1 

One panel with four 
channels 

303T rear-spar 
accelerometer 

0.04 


1 

1 

1 

B 

0.04 

0.04 

0.04 

B 

Three each wing 

303T front-spar 
accelerometer 

0.04 


1 

1 

1 

B 

0.04 

0.04 

0.04 

B 

Three each wing 

Outboard aileron (inner 
segment) bypass solenoid 

0.6 

(hold) 

1.0 

(pull-in) 

2 

B 

2 

B 

1.20 

B 

1.20 

B 

Two each wing, 
mathematical model 
in D channel 

Outboard aileron' (outer 
segment) bypass solenoid 

0.6 

(hold) 

1.0 

(pull-in) 

2 

2 

B 

B 

1.20 

1.20 

B 

B 

Two each wing, 
mathematical model 
in C channel 

Stick pusher solenoid 
(AAL actuator) 

0.6 

(hold) 

1-0 

(pull-in) 

1 

1 

1 

1 

0.6 

0.6 

0.6 

B 


Rudder bypass 
valve solenoid 

0.6 

(hold) 

1.0 

(pull-in) 

1 

B 

1 

B 

0.6 

B 

0.6 

B 


Flaperon 
bypass valve 
solenoid 

Outboard 

0.6 

(hold) 


- 

2 

2 

— 

— 

1.20 

1.20 

- 


Inboard 


2 

2 

- 

- 

1.20 

1.20 

- 

— 

PAS backup computer 

3.6 


1 

1 

1 

1 

3.60 

3.60 

3.60 

3.60 


Dedicated pitch-rate 
sensors 

0.03 


1 

1 

1 

1 

0.03 

0.03 

0.03 

0.03 


ACT Maintenance and 
Display Computer 

3.6 


B 

B 

B 

1 

B 

B 

B 

3.60 


Total dc 



B 

B 

B 

B 

12.71 

12.71 

12.11 

9.03 
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Table 22. ACT Alternating-Current Bus Loads (Amperes at 26V) 


Load unit 

Current per unit 

Units per 
channel 

Current per channel 

Comments 

Maxi- 

mum 

steady 

state 

Maxi- 

mum 

surge 

Maximum steady state 

A 

B 

c 

D 

D 

B 

C 

D 

Elevator servo LVDT 

0.25 


2 

B 

B 

B 

0.50 

1.00 

1.00 

1.00 

Only a mathematical 
model in one channel 

Outboard 
aileron 
servo LVDT 

(Outer 

segment) 

0.25 


D 

B 

B 

B 

1.00 


- 

0.50 


(Inner 

segment) 

0.25 


B 

B 

B 

B 

- 

0.50 

1.00 

1.00 


Flaperon 
servo LVDT 

Outboard 

0.25 


B 

B 

B 

B 

0.50 

- 

1.00 

1.00 


Inboard 

0.25 


D 

B 

B 

B 

1.00 

1.00 

0.50 

- 


Rudder servo LVDT 

0.25 


2 

- 

2 

1 

0.50 

- 

0.50 

0.25 


Total transformer 
load at 26V ac (amps) 







3.50 

3.50 

4.00 

3.75 


Transformer load at 
1 1 5V ac 







0.79 

0.79 

0.90 

0.85 


Transformer output, VA 







91.0 

91.0 

104.0 

97.5 


Transformer losses, VA 
(at 80% efficiency) 







22.8 

22.8 

25.2 

24.4 


Transformer input, VA 
(= inverter output) 







113.8 

113.8 

130.0 

121.9 


Inverter input, VA 
(at 60% efficiency) 







189.6 

189.6 

216.7 

203.2 


Inverter input 
(amps at 28V dc) 







6.77 

6.77 

7.74 

7.26 
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Table 23. A CT Power Supply Equipment 


Item 

ACT 

Baseline 

Number 

Rating 

Number 

Rating 

Battery® 

2 

40 Ah 

1 

40 Ah 

Battery charger® 

2 


1 


T ransformer-rectif ier 

2 

150A 

2 

120A 

Static inverter 

4 

100 VA 



Transformer, 115/26V 

4 

150 VA 



Battery-switching relay 

b 





^CT same as Baseline except quantity, 
height and cost insignificant compared 
to major equipment 
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9.0 SELECTED SYSTEM EVALUATION 


9.1 LABORATORY PERFORMANCE TESTS 

This section describes several laboratory experiments made using a typical digital flight 
control computer (the General Electric MCP-701A) to examine potentially critical 
mechanization questions. The results were encouraging in that no significant problem in 
achieving digital mechanization of the Active Controls Technology (ACT) control laws 
was found. 

9.1.1 CONTROL LAW IMPLEMENTATION EVALUATION 

The ACT control functions were designed to be implemented using currently available 
hardware technology. With the application of digital computers to airborne flight control 
systems, such control functions will be implemented in a sampled-data environment. 
Control laws for these functions were developed in the continuous domain using root locus 
synthesis and analysis techniques, and the same functions were to be translated into a 
sampled-data representation. Some discrepancies in digital system performance were 
expected because of either the programming technique used or associated hardware design 
aspects such as sample rate, analog input prefiltering, and computation delay. Laboratory 
tests were conducted to evaluate the performance of four representative ACT control 
laws implemented using the General Electric MCP-701A digital flight control computer. 
Digital control law implementation was developed beginning with an analysis of the digital 
system basic hardware performance characteristics. Next, the control laws were 
implemented and evaluated from a frequency response performance viewpoint. 

9. 1.1.1 Laboratory Setup 

The basic hardware characteristics of the General Electric MCP-701A were investigated 
using a single channel of the quadruple-channel system. Laboratory tests were conducted 
to establish the hardware input/output bandpass characteristics. 

The basic General Electric MCP-701A hardware can be represented as a prefilter, 
computation delay, and zero-order hold, as shown in Figure 91. The prefilter attenuated 
the analog input signal high-frequency components to suppress "aliasing" during the 
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1 

Analog to 
digital 

e-s<Tl +T 2 ) 

Digital to 
analog 

1 - e-^'^ 


Input 

(s/w^ + 1 ) (s/cj2 + 1 ) 



sT 

■' ■ W 

Output 


Antialiasing filter Computation delay Zero-order hold 


= 28 rad/s 
CJ 2 “ 126 rad/s 


Tf + T2 — 57^is 


Figure 9 1. Mathematical Mode! of Laboratory Computer 


analog-to-digital (A/D) conversion. Aliasing is the characteristic of an A/D process in 
which a high-frequency analog signal is sampled (any signal frequency above 
one-half the sampling rate) that results in false low-frequency signal in the discrete time 
domain. The laboratory computer prefilter was mechanized by two single-lag filters with 
fixed break frequencies of 28 and 126 rad/s as shown in Figure 91. Computation delay is 
made of two parts, the A/D conversion cycle time, T^, plus the time, T 2 , required to 
execute the program and produce a result. For the MCP-701A, the value of -i- T 2 was 
determined to be approximately 57 ps, which is negligible relative to the sampling rate 
and antialiasing filter contributions. The zero-order hold function shown in Figure 91 is 
the mathematical expression for the computer sample-hold characteristic; its time 
constant is the sampling period T. 

Frequency response of the basic General Electric MCP-701A hardware was obtained in the 
laboratory to compare the mathematical model with laboratory results. Figure 92 
presents the Bode plot of the laboratory frequency response and mathematical model for 
four different sampling intervals of 5, 10, 20, and 40 ms. The plots show that the 
mathematical model represents the actual response very closely. It further shows that 
the predominant frequency response characteristic of the hardware comes from the 
prefilter element. These results show that the digital system basic hardware 
characteristics can be mathematically modeled for analysis purposes. 

9.1. 1.2 Control Law Implementation 

Four representative ACT control laws were implemented using the laboratory computers 
for system performance evaluation. The evaluation was limited to system dynamic 
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performance. The ACT control laws selected for laboratory performance evaluation 
were: 

• Pitch-augmented stability (PAS) 

• Maneuver-load control (MLC) 

• Gust-load alleviation (GLA) 

• Flutter-mode control (FMC) 

Figure 93 shows the functional block diagram of the ACT control laws. These represent 

an early system configuration and may not be consistent with control laws given 

elsewhere in this document. It should be noted that these control laws were developed 

assuming that perturbation values of the input variables were available. No detailed 

consideration has been given to the signal processing required to handle steady-state 

signal values due to trim conditions, biases, etc. The control filters were designed in the 

continuous s-domain and mechanized in the discrete (digital) domain using the 

bilinear transformation (Tustin's substitution). The procedure is based on substituting 

2 Z-1 for s in the analog filter equation and writing difference equations to develop 
T Z-1 

algorithms for software coding. 

Frequency response data were taken for the control filters implemented using a frequency 
analyzer across the MCP-701A associated input and output channels. Figures 94 
through 99 show frequency responses of the preceding filter cases with sampling periods 
of 5, 10, 20, and 40 ms and also the theoretical predicted continuous responses. The plots 
clearly show errors in gain and phase between the measured and theoretical continuous 
responses. The measured responses have faster gain rolloff and significantly more phase 
lag due to the basic hardware characteristics discussed previously. The responses also 
show that the gain and phase differences from the theoretical decrease as the sampling 
rate is increased. Test results show that the analog input signal prefilter values must be 
included in the hardware model and, depending on the sample rate selected, can influence 
system performance. These values can be selected to change basic hardware 
characteristics, and software implementation can be used to compensate for certain 
hardware limitations. After the hardware system has been fully integrated, careful 
analysis and laboratory testing will be required to ensure that the optimum performance 
has been obtained. 


244 



I = 

I • Altitude = 7833m (25 700 ft) 

Incremental speed, | ^| 25s+ 1 I 3.77 x iq- 4 •Mach = 0.86 

u, cm/s (in/s) | ^ 5s + 1 ^ (9.58 x lO'"*) • Gross weight = 122 482 kg (270 000 lb) 

I • Center of gravity = 0.46c 
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Figure 93. A CT Control Law Functional Block Diagram 
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Figure 96. Gust-Load Alleviation Frequency Response, Third Order 
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9.1.2 SYSTEM CONCEPT EVALUATION 


The tests described in the preceding subsections essentially illustrate that the ACT 
control functions can be realized using digital technology. This subsection deals with 
special investigations conducted to evaluate various functional elements that are part of a 
redundant system configuration. 

9. 1.2.1 Laboratory Setup 

The basic laboratory equipment consisted of the following elements: 


• A digital computer simulating the ACT airplane 

• A digital redundant flight control system mechanized on flight control hardware 

• An analog computer simulating the actuators 


A block diagram of these elements, as they were interconnected for closed-loop tests, is 
shown in Figure 100. Figure 101 is a photograph of this setup, showing the four flight 
control computers in the center foreground. A Boeing-owned ECLIPSE computer was used 
to simulate the longitudinal equations of motion of the ACT airplane at several flight 


Analog computer 
(actuators) 




Surface position signals 



Outputs of controMaws 




Cross-channel link 




r~ 






~1 



MCP- 
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MCP- 
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MCP- 
701 A 


MCP- 
701 A 


Redundant General Electric MCP-701 A 
(control laws) 










Sensor data 


• ECLIPSE (ACT 
airplane dynamics) 


Figure 100. Laboratory Setup for Closed-Loop Simulation 
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Figure 101. Computer Laboratory Setup 


conditions. State variable techniques were used to implement the dynamics of the 
longitudinal axis in four rigid and six elastic modes for real-time execution. Minimum 
real-time execution for the airplane model was set at 40 iterations per second (25-ms 
sampling period). Although different flight conditions (i.e., V^, and Vj^) were 

programmed, only the flight condition was tested as a closed-loop system in the 

laboratory. Sensor data were simulated in the ECLIPSE computer and fed to the General 
Electric MCP-701A computers. 


General Electric MCP-701A flight control computers were used to implement ACT 
control laws and redundancy management. ACT control laws were programmed using an 
algorithm derived from incremental difference equations. In addition to the software 
required to realize the ACT control functions, extensive redundancy management 
software routines were coded and tested in the laboratory. A cross-channel data link 
connected the flight control computers to make up a redundant digital system 
configuration. Outputs of the computers were fed to an analog computer. 
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An EAI-PACER 500 analog computer was used to simulate servoactuators. Simple lag 
filters represented the ACT actuation system. Surface position signals from the analog 
computer were fed back into the airplane simulation to close the loop. 

9.1. 2.2 Synchronous and Asynchronous Computer Operation 

The Segregated System mechanizes each ACT control law in a separate dedicated 
computer set, whereas the Integrated System implements all ACT control laws using one 
computer set. Because both system concepts were designed to operate in a redundant 
system configuration, additional multiple computer hardware and software packages 
would be required in the Segregated System. To minimize hardware and software 
complexity, the dedicated computers of the Segregated System and the Essential PAS 
Computers of the Selected System were designed to be operated asynchronously. A series 
of laboratory closed-loop tests was conducted to verify that implementation of each ACT 
control law in a redundant system is feasible in computers operating either synchronously 
or asynchronously. The testing involved simulation of the quadruply redundant PAS and 
triply redundant EMC control functions, each operating in closed-loop configuration, as 
described in Subsection 9. 1.2.1. 

The tests were conducted separately with each redundant control system. The simulated 
pilot input continuously disturbed the simulated ACT airplane with a 0.1-Hz sinusoidal 
column input command for a period of 1 hr while the control computers operated 
synchronously. The same test procedure was repeated with the control computers 
operating asynchronously. 

A high-amplitude pilot input command (on the order of 15 deg of elevator deflection 
command) was provided to investigate control computer drift. Control computers drifting 
with respect to each other would each sample similar input signals at different times and 
produce dissimilar output signals. For the worst case, these differences in output signals 
will be more pronounced if the drift is large and the input signals contain high-frequency 
components. 

During the tests, the aircraft parameters were continuously recorded to note any response 
disparity between the two modes of computer operation. Further, synchronous and 
asynchronous operations were verified by monitoring the clock signals on a four-channel 
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oscilloscope. The test results obtained were compared, and no differences in response 
were apparent. Computer drift did not affect the response; drift time was negligible 
compared with the sampling period. Further, these input signals are processed by a signal 
selection and failure detection (SSFD) algorithm that selects an appropriate signal for the 
control law computations. This SSFD concept, discussed in Subsection 9. 1.2. 3, is used in 
the ACT system design to isolate input signal failures and produce identical computer 
output commands in a redundant system configuration. 

Laboratory tests indicate that each ACT control function implemented in control 
computers operating asynchronously can achieve the same performance as the control 
computers operating synchronously. 

9. 1.2.3 Signal Selection and Failure Detection 

All redundant systems require some form of SSFD if fault isolation is required. Digital 
computers can be effectively multiplexed to provide SSFD functions for processing 
incoming variable signals. The following discusses SSFD functions that process triple 
sensor output information by a median selection or an averaging algorithm if a failure is 
detected. Median selection simply provides a signal output that is the median signal of 
three incoming sensor signals. If two signals are identical, the median will be that signal. 
If one failure is detected, the averaging algorithm provides a signal output that is the 
average of the remaining two valid sensor signals. Sensor output data are first converted 
to digital form and then cross fed to the other remaining channels via a cross-channel 
data link. Each individual computer channel of the redundant system collects the sensor 
output data and then derives and tests differences to detect sensor failures. Two SSFD 
functions were coded for real-time tasks: one that processes pitch-rate sensor outputs 
and one for acceleration sensor outputs. 

Tests were performed to simulate sensor output failures, both "zero" failures (sensor 
output goes to zero) and "hardover" failures (sensor output goes to a plus or minus 
maximum value), and evaluate the two SSFD functions for the quadruply redundant PAS 
and triply redundant FMC configurations, each operating in a closed-loop system 
(subsec 9. 1.2.1). Evaluations were made by observing the simulated ACT airplane time 
history for "normal" system operation (no failures) followed by various combinations of 
sensor output failures. 
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Both the quadruply redundant PAS and the triply redundant FMC achieved performance 
requirements during this test. Following two pitch-rate sensor failures for PAS or one 
acceleration sensor failure for FMC, the observed aircraft parameters showed normal 
performance. Following a third pitch-rate sensor failure or second acceleration sensor 
failure, the redundant control system automatically shuts down, resulting in an open-loop 
airplane. It should be noted that the open-loop ACT airplane is stable at the Vj^q flight 
condition tested. The following paragraph discusses the 5SFD process for the quadruply 
redundant PAS system. SSFD is described in more detail in Section 8.0. 

The quadruply redundant PAS system design must be operational following any two sensor 
failures, providing all required functions with no performance degradation. The signal 
selection concept for the quadruply redundant configuration uses an active-standby, online 
technique. Three out of four incoming sensor signals are designated active and processed 
by the SSFD algorithm; the fourth is on standby. When the first active signal failure is 
detected, the fourth input is switched into an active mode. 

If no fault is detected, the median algorithm is selected. If one fault is detected, the 
standby signal switches to an active mode and the median algorithm is again selected. If 
two faults are detected, the averaging algorithm is selected. Following a third failure, 
third-failure information is generated to shut down the PAS control computers. 
Figure 102 illustrates the process just described. The slightly biased pitch-rate sensor 
outputs and the elevator deflection commands shown were obtained by disturbing the 
simulated ACT airplane with a 0.1-Hz sinusoidal pilot input command. 

The median-selection process input signal can exhibit an abrupt change when one signal 
fails to a handover state and that signal was in, or passed through, the middle region of 
the three signals. Figure 102 shows that suppression of the transient associated with 
handover failures can be achieved. These abrupt responses are softened by inserting an 
equalization loop around the median-selection function. The selected output is the 
median signal of the equalized input signals, where the input signals are continously being 
equalized toward the selected output. The equalization technique forces the inputs to the 
median-selection algorithm to be nearly identical. 

The two SSFD algorithms were evaluated using the simulated ACT airplane having PAS 
and FMC control laws, respectively. Various types of sensor signal failures were 
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Figure 102. Quadruply Redundant Pitch-Augmented Stability Pitch- 


Rate Sensor Failures 


introduced (e.g., handover and zero failures) with satisfactory test results. These SSFD 
functions can be used to prevent sensor output signal failures from disturbing the airplane 
response and to extend the operational reliability of the flight control system. 
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9. 1.2.4 Actuator Recovery From Computer Transient 


Many computer shutdowns can be attributed to transient failures of software or hardware. 
Laboratory testing was conducted to establish that an ACT computer actuator system can 
recover from such transient failures. 

The dual force-summed actuator used in the laboratory test is described in detail in 
Subsection 8.1.3. Because each servoactuator channel is directly commanded by an 
associated processor, failure of a computer will temporarily shut down its associated 
servo to prevent deterioration in performance or possible structural damage. The 
temporarily disconnected actuator must then be brought back into the system smoothly 
when the transient failure of the computer disappears. A hydraulic bypass valve is 
incorporated into the actuator design to shut down the actuator when it or the computer 
driving it fails. The same bypass valve is also used to reactivate the actuator if the 
system recovers to normal operation. 

Testing involved simulation of the dual force-summed actuator model and the PAS 
system. Figure 103 shows the laboratory setup for closed-loop tests. The ECLIPSE 
computer, described in Subsection 9. 1.2. 1, implements the longitudinal equations of 
motion of the ACT airplane at different flight conditions. The dual force-summed 
actuator model was implemented in one MCP-701A digital computer operating in real 
time at 200 iterations per second (5-ms sampling period). The bypass valve was simulated 
by a digital first-order lag filter with a time constant of 0.01 sec. The output signal of 
the lag filter falls exponentially to zero when bypass is requested and returns to its 
nominal value when bypass is no longer requested. The bypass signal is activated when a 
failure is detected. Computer failure was simulated by shutting down one of the 
computers driving one actuator, then an appropriate signal was introduced from the 
analog computer to simulate the output of the failed computer. The actuator was 
programmed to detect the failure 0.5 sec after the computer failure had occurred. 
Identical PAS control laws were contained in three MCP-701A digital computers operating 
asynchronously in real time at 200 iterations per second (5-ms sampling period). A cross- 
channel data link connected the three digital computers. The PAS control laws were 
integrated with the redundancy management software to realize a triplex redundancy 
scheme. 
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Figure 103. Laboratory Setup for Pitch-Augmented Stability Closed-Loop Simulation 


The control law equation implemented was 

«1202 + 3-77 * 

where 

^1202 
Au 

®COL 

The analog computer was used to add three voltage biases to the pitch-rate sensor signals 
from the ECLIPSE computer and to provide a method of introducing sensor failures. All 
data used in the simulation correspond to flight condition 


= pitch-rate sensor output, station 1202, deg/s 
= incremental horizontal velocity, body axis, m/s 
= column input signal, deg 
= elevator deflection command, deg 
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Figure lO^f(a) shows the closed-loop short-period response to a 6-deg step column input 
with PAS control law implemented on a digital computer. Figure 104(b) shows the same 
system responses to the same input with PAS control law implemented on an analog 
computer. Responses from the two test methods are closely matched. 

Tests were performed using a sinusoidal signal at 0.1 Hz. Figure 103(a) 

shows the closed-loop system responses to a hardover failure (e.g., computer output 
command goes to maximum value). When the failure is removed and the failed computer 
recovers to its normal operation (e.g., back on line), a time delay occurs before the PAS 
computer outputs command the same actuator positions. This is due to reinitialization of 
software parameters following computer startup and the 1.25-sec lag on the 
command signal path. Figure 105(b) shows the same system responses for the case where 
the 1.25-sec lag filter was removed. The PAS computer outputs are identical. 
Figure 106(a) and (b) shows the closed-loop system responses for both "zero" failure 
(computer output goes to zero value) and oscillatory failure (computer output goes to 
+ maximum value), respectively, with a 0.1-Hz sinusoidal ^coL signal input, 

including the lag filter on its path. 

This study indicates that if the ACT system has integrating functions or very-low- 
frequency filters, the transient response during recovery will be large and may not be 
acceptable. For this case, the system must incorporate a more sophisticated recovery 
technique, such as exchange of filter data between the computers, so that the transient 
response will be within acceptable levels. The control laws synthesized during the lAAC 
Project, however, have fairly high frequency, and the simple recovery mode is adequate. 

Figure 106(c) shows the closed-loop system responses to a hardover computer failure with 
no 5 qol command. The failures excited a lightly damped 1.0-Hz oscillatory mode 
of the basic ACT airplane response. 

Laboratory tests verified the reconfiguration method of the dual force-summed actuator 
operating in a closed-loop configuration. 
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Figure 104. Short-Period Response to Step Column input 
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Figure 105. System Response to Hardover Failure 
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Figure 106. System Response to Computer Failure 





9.1.3 ACTUATOR EVALUATION 


9. 1.3.1 Actuator Failure Mode and Effect Analysis 

An actuator failure mode and effect analysis (FMEA) has been conducted for the ACT 
secondary actuation and ACT fly-by-wire (FEW) power control unit actuation systems 
described in Subsection 8.1. The analysis was conducted based on major component 
breakdowns as shown in Figures ^5 and 46. 

The results are shown in Tables 24 and 25. The following can be concluded from the 
analysis: 

• For a crucial ACT function: 

• The actuator meets the fail-operational/fail-operational requirement against 
any two component failures, excluding jamming failure. 

• The actuator meets the fail-operational requirement against any single 

jamming failure. 

• For a critical ACT function: 

• The actuator meets the fail-operational requirement against any single 

component failure, excluding jamming failure. 

• The actuator meets the fail-safe requirement after a second component 
failure. 

• The actuator will be shut down after a jamming failure. 

9. 1.3.2 Performcmce Evaluation of Force-Summed Actuators 


Subsection 8.1.3 and Figure 45 describe the force-summed secondary actuator concept for 
application in the ACT control system. A simulation study has been conducted to verify 
the design concept. The following questions were answered in the simulation study: 
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Table 24. Force-Summed Secondary Actuation System Failure Mode and 
Effect Analysis 


Item identification 
name ® 

Item function 

Type of failure or 
error 

Detection method 

Failure effects 
subsystem operation 

Electronics 

Computer command 
signals, close servo loop 
current feedback, etc 

Fail, no output due 
to power toss, 
loose connections, 
fracture, overheat 

Failure detector 
or preflight test 

Lose one channel 



Fail, hardover due 
to hot short or 
overheat 

Failure detector or 
preflight test 

Lose one channel, small 
failure transient 

LVDT 

@ 

To close actuation 
position loop 

Fait, no output or 
power loss, loose 
connection or short 

Failure detector 
or preflight test 

Lose one channel, small 
failure transient 

LVDT 

To measure electro- 
hydraulic valve spool 
position and use it to 

Fail, no output due 
to open circuit or 
power loss 

Failure detector 
or preflight test 

None 

@ 

detect failure by 
comparing with other 
channels 

Fail, hardover due 
to jam or short 

Failure detector 
or preflight test 

Inadvertent channel 
shutoff 

Bypass valve 

Solenoid-operated 
on off valve used to 
bypass a failed 
channel 

Failure to open due 
to jam or electrical 
open or loose 
connection 

Preflight test 

None 

® 


Fail, open inadvert 
ently due to short 
circuit 

Failure detector 
or preflight test 

Inadvertent channel 
shutoff 

Valve feedback spring 
© 

To close electrohy- 
draulic valve position 
loop 

Disconnect or break 
causes valve to go 
hardover 

Failure detector 
or preflight test 

Lose one channel, small 
failure transient 


To transfer electric 
signal to valve position 

No output due to 
leakage or break 

Failure detector 
or preflight test 

Lose one channel, small 
failure transient 

© 


Hardover due to clog 
or jam in the fluid 
nozzle 

Failure detector 
or preflight test 

Lose one channel 

Second stage electro- 
hydraulic valve 

To control fluid flow 
to the actuator 

No output due to 
excessive leakage 

Preflight test 

Lose one channel 

@ 


Offcenter due to 
jam or leakage that 
causes actuato*^ 
hardover 

Failure detector 
or preflight test 

Lose one channel, small 
failure transient 

Centering spring 
© 

To provide hard point 
for pilot's mechanical 
input 

Fail, break, or jam 

Maintenance 

inspection 

None, unless both 
channels fail and 
both spring breaks 

Actuator 

To provide force 
voting and 

Leak due to break 
or seal failure 

Preflight test 

Lose one channel 

© 

mechanical input to 
PCU 

Jam 

Failure detector 
or preflight test 

Lose one channel for 
triple actuator, lose 
function for dual 
actuator 

Pogo 

To disconnect a jam 
med mechanical path 

Spring break 

Failure detector 
or preflight test 

Lose one channel 

Connectors 

o 

T 0 provide electric 
power signal for 
electrohydrauhc 
valve, shutoff 
valve. LVDT 

Break or short 

Failure detector 
or preflight test 

Lose one channel 


Two failures in Por two-actuator system, any two independent failures or an actuator 

different channels jani will cause inoperative system 


For three-actuator system, any three independent failures or any two 
actuator jams will cause inoperative system 
^Numbers identify the component shown in Figure 45 
^This device is used in three-actuator PAS function only If one of the 
three actuators is jammed and full hydraulic pressure or bypass fails to 
free it, the combined force of the other two will break the pogo loose 
There is no pogo in two-actuator system 
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Table 25. Force-Displacement Actuator Failure Mode and Effect Analysis 


Item identification 
name* 

— 
Item function 

Type of 
failure or error 

Detection method 

Failure effects 
subsystem operation 

Electronics 

Amplify input signals, 
close servoloop, 
current feedback, etc. 

Fail, no output due 
to power loss, 
loose connections, 
fracture, overheat 

Failure detector 
or preflight test 

Lose one electrical 
channel 

© 


Fail, hardover due 
to hot short or 
overheat 

Failure detector 
or preflight test 

Lose one electrical 
channel, small fail 
transient 

LVDT 

To close actuation 
position loop 

Fail, no output or 
hardover due to 
power loss, loose 
connection, or short 

Failure detector 
or preflight test 

Lose one electrical 
channel, small fail 
transient 

LVDT 

To detect hydraulic 
channel failure 

Fail, no output due 
to power failure or 
loose connection 

Preflight test 

None 

© 


Fail, hardover due 
to short or lam 

Failure detector 
or preflight test 

Inadvertent shutoff of 
one hydraulic channel 

Hydraulic shutoff 
valve 

To shut off electro- 
hydraulic valves in 
the failed channel 

Failure to close due 
to jam or electrical 
open or loose 
connection 

Preflight test 

None 

® 


Fail, closed inadver- 
tently due to short 
circuit 

Failure detector 
or preflight test 

Inadvertent shutoff 
of one hydraulic 
channel 

Valve feedback spring 
© 

To close electrohy- 
draulic valve position 
loop 

Disconnect or break 
causes valve hard- 
over 

Failure detector 
or preflight test 

Lose one hydraulic 
channel, small fail 
transient 

First-stage electrohy- 
draulic valve 

To transfer electric 
signal to valve posi- 

No output due to 
leakage or break 

Failure detector or 
preflight test 

Lose one hydraulic 
channel 

® 

tion 

Hardover due to 
clog or jam in the 
fluid nozzle 

Failure detector or 
preflight test 

Lose one hydraulic 
channel 

Second-stage electro- 
hydraulic valve 

To maintain valve 
position and to control 

No output due to 
excessive leakage 

Failure detector 
or preflight test 

Lose one hydraulic 
channel 

© 

the mam spool 

Offcenter due to 
jam or break 

Failure detector 
or preflight test 

Lose one hydraulic 
channel 

Main valve spool 

To control hydraulic 
flow to the actuator 

Excessive leakage 
due to erosion 

Failure detector 
or preflight test 

Lose one channel 

mHiH 


Jam 

Failure detector 
or preflight test 

May cause total loss 
of function 

Actuator 

To control surface 
position 

No force output due 
to excessive leakage 
or crack 

Preflight test 

Lose one hydraulic 
channel 

® 


Jam 

Failure detector 

Inoperative system 

Connectors 

o 

Provide electric 
power, signal for 
electrohydraulic 
valve, shutoff 
valve, LVDT 

Break or short 

Failure detector 
or preflight test 

Lose one electrical 
channel 


Double failures' Any two electric or any two mechanical failures, one in each channel, or a 
single jam in the main spool or actuator, will cause the inoperative actuator 
system 


'Numbers identify the components shown in Figure 46. 
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• In normal operation, how high is the force-fight level caused by various component 
tolerances? 

• How can the failure transient be predicted? How does one design the failure logic, 
threshold, and timing? 

• What kind of mathematical model is needed to track valve spool motion? 

Computer Simulation Construction- The dual force-summed actuator configuration was 
selected for the simulation study because it represents typical even-numbered-channel 
force-summed actuator characteristics. The force-summed actuator tends to present a 
dead-band characteristic when operated in an even-number-of-channels configuration. 
Figure 107 shows a block diagram of the computer simulation, which includes two 
hardware actuator channels and one mathematical model used as a failure monitor. The 
parameters have been collected from vendor catalogs, test data, or other documents and 
represent typical servoactuator parameters. A simple first-order lag (840 rad/s) was used 
to compute valve spool position. The mathematical model used in the failure monitor is 
represented by spool position; i.e., no lag. Major position loop gain was 80 rad/s, as was 
the actual hardware tested. Because a prior laboratory test of a single-channel actuator 
showed sufficient stability margin, no attempt was made to use the computer simulation 
for stability check or compensation. Most of the parameters associated with force fight 
and failure transients were well represented; i.e., valve dead zone, null shift, feedback 
spring rate, etc. Force-fight level was set to be proportional to the difference between 
actuator positions and combined structure compliance. The position output, which is also 
the feedback signal of the valve spool "mathematical model," is the average of the two 
actuator positions. 

Cross-channel comparators between the valve spool positions and the mathematical model 
were used for failure logic design. Figure 108 shows the flow diagram of the failure logic. 
Every time the valve spool position difference exceeds the threshold, the detector counts 
up four; every time valve spool position is within the threshold, it counts down one. This 
device effectively detects high-frequency oscillatory failure. Threshold was set at 25% of 
the full stroke, and average detect time was about 50 ms. The threshold was large enough 
and the timing was long enough so that chances of false alarms were minimized (several 
trial runs verified this). These numbers can be changed easily if necessary, even after the 
airplane is in operation. The failure logic used should be able to detect all hardover- or 
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Figure 107. Force-Summed Actuator Simulation 
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oscillatory-type failures. Passive failures will be detected when the error signal exceeds 
the threshold by an amount equivalent to a large airplane motion. The preflight procedure 
will detect passive failures. 

Simulation Results— Figure 109 shows three identical input signals fed into the two 
identical actuation channels (possible only mathematically) and one simplified 
mathematical model. The simplified model is representative of the model that would be 
part of the actual monitor implementation. Both actuators have identical outputs and no 
force fight. The mathematical model, which represents spool position without lag, 
tracked the real spool positions closely. 

Figure 110 shows a computer run with a reasonable combination of component tolerances 
in each channel. The position difference between the actuator outputs is small enough so 
that both actuator positions still look identical. This is evidenced by the appearance of a 
small force fight between actuators. 

Figure 111 simulates a hardover failure. The trace shows that at 0.11 sec, the No. 1 valve 
suddenly fails hardover. Then, as the No. 2 valve and mathematical model go in the 
opposite direction to keep the No. 1 actuator from running away, a maximum force fight 
exists between the two actuators. At approximately 0.14 sec, the failure is detected and 
the No. 1 actuator is bypassed. Hydraulic pressure difference across the piston drops to 
zero. As soon as the failed actuator is bypassed, the good actuator takes over and the 
output follows the computer input the same as before the failure occurred. The failure 
transient is very small. Before the failed channel is bypassed, the output to the power 
control unit is the average of the two actuator positions that essentially still follows the 
input. After the failed channel is bypassed, a large dip occurred. In an actual case, it 
would take a much longer time to bypass the hydraulic pressure, and the dip would be 
much smaller. 

Figure 112 shows that the failure detector is also able to detect oscillatory-type failures 
at high frequencies. The mathematical model and the good valve spool position are 
tracking each other, and a large position error exists between the good and the failed 
valve spools, sufficient to trigger the failure detectors. Further investigations into 
actuator responses to computer transients were conducted in the laboratory and are 
covered in Subsection 9. 1.2.4. The simulation study shows that secondary actuators with 
mathematical model are a feasible and acceptable approach for the ACT system design. 
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Figure 109. Force-Summed Actuator Simulation, Identical input 
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Force fight, N Hydraulic Mathematical Valve spool Actuator position, mm Computer 

pressure, kPa model, mm position,mm input, V 
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Figure 1 12. Force-Summed Actuator Simulation, Oscillatory Failure 
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9.2 RELIABILITY ASSESSMENT 


9.2.1 COMPONENT RELIABILITY DATA 

Reliability of the individual ACT functions and of combinations of those functions depends 
upon the failure rate of their components and upon their configuration. The best source 
for reliability data was experience with the components in commercial service. If that 
information was not available, the manufacturer's quoted failure rate or an analysis by 
subcomponents from MIL-HDBK-217C was used. Values used and their sources are listed 
in Table 26. 

9.2. 1.1 Partitioning of Line Replaceable Unit Failure Rates 

The reliability studies of the Integrated and Segregated Systems assumed that any failure 
of a line replaceable unit (LRU) represented total failure of the unit. Actually, a multiple 
data source such as the digital air data computer (DADC) or the inertial reference system 
(IRS) can partially fail and still provide some of the data correctly. Benefits can be 
realized by extracting (when possible) the desired information where it is first produced. 
Thus, the pitch and yaw rate and normal acceleration will be extracted from the IRS in 
analog form without being converted to digital form and operated upon by the IRS 
computer. The DADC dynamic pressure and angle-of-attack outputs will also be 
extracted as analog signals. Similarly, the entire primary computer need not always be 
used. Table 27 shows how the LRUs were broken down into subcomponents to select the 
necessary subcomponents and subcomponent failure rates for each application. 

This ability to intercept an analog signal before it becomes subject to the potential 
failures of other parts of the LRU does improve system reliability, but some of the 
differences noted in Subsection 9.2.2 is only a consequence of the improved method of 
calculating reliability. 

9.2. 1.2 Failure Rates of Supporting Systems 

The ACT functions require support from the airplane electric, hydraulic, and pneumatic 
systems. The pneumatic system is used only in the angle-of-attack limiter (AAL) and 
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Table 26. Failure Rates of ACT Components 


Systenn elements 

MTBF, flight hours 

Failure rate per 10 
flight hours 

Data source 

ACT secondary actuator by parts: 
Power piston and servovalve 

6.25 X 10^ 

1.6 

NASI -14742 

T-valve 

105 

10.0 

Boeing data 

LVDT servovalve 

1.43 X 10® 

7.0 

NASACR-145271 

LVDT power piston 

1.43 X 105 

7.0 

NASACR-145271 

Solenoid bypass valve 

1.66 X 105 

6.0 

Boeing data 

Total secondary actuator 

31 600 

31.6 

Sum of above 

Single-wire segment 

5x 10® 

0.2 

Boeing data 

Connectors: 

10-pin stanchion connector 
{for Essential PAS) 

II.Ox lof 

0.09 

MIL-HDBK-217B 

20-pin stanchion 

7.14 X 10® 

0.14 

MIL-HDBK-217B 

10-pin production break 
(uninhabited environment) 

5.09 X 106 

0.196 

MIL-HDBK-217B 

20-pin production break 
(uninhabited environment) 

3.29 X 10® 

0.304 

MIL-HDBK-217B 

200-pin rack and panel 
computer connector 

2.78 X 10® 

3.6 

MIL-HDBK-217B 

Secondary actuator mechanical 
voter 


0 

Multiple mechanical failures 

Hydraulic power 
A 

11 500 

87.0 

required to cause malfunction 
Boeing data 

B 

71 400 

14.0 

Boeing data 

C 

71 400 

14.0 

Boeing data 

Pneumatic power (for AAL) 

- 

0 

Supplied by both engines and 

Electric power (per channel) 

_ 

0.001 

accumulator 
Subsection 9.2.1 .2 

Actuator, triple electric and 
duplex hydraulic: 

Electrohydraulic valves (four) 

46 900 

21.3 

Boeing data on comparable 

Power piston and servovalve 
(two) 

6.25 X 10® 

1.6 

parts 

NASI -14742 

Hydraulic bypass valve (two) 

1.67 X 105 

6.0 

Boeing data 

Total actuator, aileron. 

5.55 X 10® 

1.8 

A combination of the above. 

outboard, inner segment 



allowing for redundancy 
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Table 26. Failure Rates of ACT Components (Continued) 


System elements 

MTBF, flight hours 

Failure rate per 10 
flight hours 

Data source 

Actuator, aileron, outboard 
(inner segment) 

5x10® 

2.0* 

From above components 

Actuator, secondary, outboard 
aileron outer segment 

27 900 

35.9* 

Boeing data 

Actuator flaperon 

33.800 

29.6* 

Vendor MTBF 

Actuator, secondary, elevator 

25 900 

38.6* 

Boeing data 

Actuator, secondary, rudder 

26 700 

37.4* 

Boeing data 

Actuator, stick pusher 

20 000 

50.0* 

Boeing data on similar 727 
thrust reverser actuator 

Actuator, stick shaker 

10® 

1.0 

727 experience 

Computer, essential (see 
subsec 9.2.1. 3 for breakdown) 

12 000 

83.0 

Vendor data for similar 
component 

Computer, primary (see 
subsec 9.3.1 .3 for breakdown) 

6 620 

151.0* 

Vendor data 

Computer, management 

6 620 

151.0* 

Vendor data 

Sensor, accelerometer, FMC 

18 400 

54.35* 

Boeing data 

Sensor, accelerometer, GLA 

18 400 

54.35* 

Boeing data 

Digital air data computer (DADO 
(see subsec 9.2. 1.3 for breakdown) 

11 765 

85.0* 

Vendor MTBF 

Sensor, inertial reference system 

2 392 

418.0* 

Vendor MTBF 

Sensor, angle of attack (used 
with DADC, see subsec 9.2.1. 3) 

15 400 

65.0* 

727 experience 

Sensor, flap position (LVDT) 

91 000 

11.0* 

NASACR-145271 

Sensor, wheel position (LVDT) 

91 000 

11.0* 

NASACR-145271 

Valve, solenoid, stick pusher 

65 400 

15.3* 

Boeing data 


*lncluding connections and wires 


provides bleed air from both engines. An additional backup is the low-pressure 
accumulator. Because this system is a simple adjunct to the necessary engines, it was felt 
that any additional airplane unreliability caused by the AAL use of pneumatic power 
would be negligible. 


Hydraulic power is essential to safe flight of the Baseline Airplane. A ground rule has 
been that the ACT unreliabilities are to be the incremental unreliabilities beyond those of 
the Baseline Airplane. However, because the three hydraulic systems are used in many 
places in ACT, the reliability calculations are made more meaningful if the contributions 
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Table 27. Partitioned Failure Rates 


— 

Line replaceable unit and its 
component functions 

Failure per 10® 
flight hours 

MTBF, flight 
hours 

Primary computer 

151.0* 

6 620 

CPU and memory 

40.6* 

24 600 

Servoamplifiers 

17.8* 

56 200 

Input set, including: 
Cross-channel communication 

66.6* 

15 000 

Common parts 

26.0* 

38 500 

Digital air data computer 

85.0* 

11 800 

asensor (analog) 



(includes a. vane at 65) 

70.8* 

14 100 

q sensor (analog) 

44.6* 

22 400 

Common parts 

18.2* 

55 000 

Digital (computer) parts 

18.2* 

55 000 

Inertial reference system 

418.0* 

2 392 

Yaw-rate sensor (analog) 

20.3* 

49 300 

Pitch-rate sensor (analog) 

20.3* 

43 900 

Normal acceleration (analog) 

31.7* 

31 500 

Computer parts 

118.5* 

8 440 

Common parts 

31.0* 

32 200 


‘Including connections and wires 


from the three hydraulic systems are included; hence, the differing hydraulic system loss 
rates of Table 26 are included in the fault trees as multiple-occurring events. 

The electric system has been especially designed to provide an extremely low probability 
of loss of all four electric channels and of loss of individual channels. Each channel is 
supported from both an airplane dc bus and a battery. No two channels have the same two 
sources. The airplane dc buses support each other and are themselves powered from ac 
buses that have multiple sources of supply. A fault tree illustrating the failure paths 
necessary to produce channel failure is shown in Figure 113. Input events shown in double 
circles are sets of components combined to simplify the drawing. Figure 114 shows 
components of these sets, and Table 28 lists failure rates used for the components. 
Analysis of the fault tree by the FTREE program (vol. II, app B) yielded the failure rates 
in Table 29 for several different takeoff conditions. It should be understood that when 


280 









281 















Figure 1 13. Fault Tree for Electric System (Continued) 


failure rates such as 10 or 10 appear, they represent only "less than 10”^*^." The 
nunnbers shown are presented for comparison but should not be interpreted as absolute 
values. 


The electric system enters into the ACT systems in many places and in very involved 
ways. To consider this dependency when calculating the ACT function would have been 
extremely costly in time and computer use. Because the failure rates are small, the 
electric system does not contribute significantly to the ACT failure rate. Accordingly, it 
was not necessary to enter electric failure rates into the fault trees. 
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Figure 1 14. Sets of Components Reducible to One Component 
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Figure 1 14. Sets of Components Reducible to One Component (Continued) 
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Table 28. Electric Power System Component Failure Rates 


Failure 

probability, 

X 10"®/h 

Source of failure rate 

Name of event 

942.0 

See Figure 1 14, ac bus set 

ac bus 1 set 

942.0 

See Figure 1 14, ac bus set 

ac bus 2 set 

3532.0 

See Figure 114, APU set 

Auxiliary power unit— fail to start and run 

3059.0 

See Figure 1 14, APU set 

Auxiliary power unit— fail to continue to run 

40.0 

Boeing experience and Rome Air 

Over 90-kVA load, switch to one generator, excess 


Development Center (RADC) 

not shed 

3.2 

Boeing experience and RADC 

Left bus tie breaker— fails open 

3.2 

Boeing experience and RADC 

Right bus tie breaker— fails opfen 

93.0 

Boeing calculation 

Bus power control unit— all failure modes 

13.2 

See dc bus set 

dc bus 1 set 

13.2 

See dc bus set 

dc bus 2 set 

3.2 

Boeing experience and RADC 

dc tie breaker— fails open 

288.0 

See Figure 1 14, hot battery 2 set 

Hot battery bus 1 set 

288.0 

See Figure 1 14, hot battery 2 set 

Hot battery bus 2 set 

3.2 

Boeing experience and RADC 

Battery power breaker 1 contact 3— fails open 

3.2 

Boeing experience and RADC 

Battery power breaker 1 contact 2— fails open 

3.2 

Boeing experience and RADC 

Battery power breaker 2 contact 3— fails open 

0.2 

Boeing experience and RADC 

Battery power breaker 2 contact 3— fails open 

1.0 

(VIIL-217— all modes 

Computer power input diode 1— fails open 

1.0 

MIL-217— all modes 

Computer power input diode 2-fails open 

1.0 

MIL-217— all modes 

Computer power input diode 3— fails open 

1.0 

MIL-217— all modes 

Computer power input diode 4-fails open 

1.0 

MIL-217— all modes 

Computer power input diode 5— fails open 

1.0 

MIL-217— all modes 

Computer power input diode 6— fails open 

1.0 

MIL-217— all modes 

Computer power input diode 7— fails open 

1.0 

MIL-217— all modes 

Computer power input diode 8— fails open 

0.1 

Boeing estimate 

ACT T-R bus 1— short circuit to ground 

0.1 

Boeing estimate 

ACT T-R bus 2— short circuit to ground 

0.1 

Boeing estimate 

Battery bus 1— short circuit to ground 

0.1 

Boeing estimate 

Battery bus 2— short circuit to ground 

1.0 

MIL-217C— all modes 

Computer power input diode 1— short circuit across junction 

1.0 

MIL-217C— all modes 

Computer power input diode 2— short circuit across junction 

1.0 

MIL-217C— all modes 

Computer power input diode 3— short circuit across junction 

1.0 

MIL-217C— all modes 

Computer power input diode 4— short circuit across junction 

1.0 

MIL-217C— all modes 

Computer power input diode 5— short circuit across junction 

1.0 

MIL-217C— all modes 

Computer power input diode 6— short circuit across junction 

1.0 

MIL-217C— all modes 

Computer power input diode 7-short circuit across junction 

1.0 

MIL-217C— all modes 

Computer power input diode 8— short circuit across junction 

1.0 

Arbitrary value to examine sensitivity 

(Probability the charger failed in previous flights and was 

1.0 

Arbitrary value to examine sensitivity 

not noticed by crew) 
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Table 29. Electric System Failure Rates 


Takeoff 

condition 

Propability of all ac 
channels inoperative 
(i. e., probability of 
being dependent 
upon battery alone) 

Probability of 
one channel 
inoperative 

Probability of three 
of four ACT channels 
inoperative (system 
failure) 

Two engine-driven 
systems on line 
and APU operable 
but not running 

3.3 X 10'^ 

2.97 X 10"''° 

2.91 X 10' 

Two engine-driven 
systems on line 
and APU inoperable 

- 

4.63 X 10'''° 

4.95 X 10''''^ 

No. 2 engine-driven 
system and APU on 
line; other engine- 
driven system 
inoperable 


8.35 X 10’''° 

1.6x 10’''^ 


9.2.2 IN-FLIGHT SCHEDULE RELIABILITY 

Reliability of the Selected System during in-flight operation has been predicted using the 
BCAC fault tree (FTREE) model as described in Volume II, Appendix B (subsec B.4.2). The 
results are presented in Tables 30 through 32. This assessment differs in two significant 
ways from those conducted for the Integrated and Segregated Systems. First, the 
selected crucial short-period PAS electronics is mechanized in the separate, four-channel, 
independent hardware and software of an Essential PAS backup function, while Full PAS is 
performed by triple ACT Primary Computers. Second, the major sensors and the 
computer LRU failure rates have been allocated down to the section or module level to 
obtain more realistic function failure probabilities (subsec 9. 2. 1.1). 

9.2.2. 1 ACT System Reliability 

Table 30 shows the probability of occurrence of flight restriction and flight diversion for 
the Selected System and provides data previously developed for the Integrated and 
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Table 30. Probability of Occurrence of Flight Diversion and Flight Restriction 



Probability of event occurrence in 

1-hr flight 

Flight envelope change 

Integrated System 

Segregated System 

Selected System 

Flight restriction 

2.51 X 10"^ 

3.27 X 10'^ 

1.73 X 10"^ 

Flight diversion 

7.08 X 10'^ 

2.56 X 10"^ 

4.00 X 10^ 

Flight diversion not 
including contribution 
from crucial PAS 

Not applicable 

Not applicable 

4.00 X 10"^ 


Table 31. Probability of Failure of Individual ACT Functions 



Probability of failure in 1-hr flight 

ACT function 

Integrated System 

Segregated System 

Selected System 

PAS (short or Essential) 

3.49 X 10"^° 

2.46 X 10~’’ 

5.56x 10"''2 

PAS (speed) 

1.67 X 10"^ 

1.67 X 10’^ 

- 

PAS (Full) 

- 

- 

1.73 X 10"^ 

LAS 

1.13 X 10‘® 

3.88 X 10‘® 

2.93 X 10"® 

FMC 

3.93 X 10"® 

3.88 X 10"® 

2.86 X 10"^ 

WLA 

1.21 X 10”® 

1.21 X 10"® 

5.15x 10"^ 

AAL 

4.26 X 10"^ 

1.13 X 10"® 

2.97 X 10"^ 

AAL, inadvertent 
operation 

— 

— 

5.96 X 10"^® 

AAL, both stick pusher 
and stick shaker 

— 

— 

2.55 X 10"^ 


Segregated Systems. The Selected System has lower probability of occurrence than the 
comparable Integrated System because failure rate allocations have been made at the 
module level rather than at the LRU level. The gain schedule signal in the ACT PAS and 
lateral/directional-augmented stability (LAS) functions is furnished by either the DADC 
or by flap position, and single-thread operation is permitted for the LAS function. 
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Table 32. Selected Configuration Studies 


Condition different from Selected System being evaluated 

Probability of event 
at left per 1-hr flight 

Probability of 
Selected System 
for comparison* 

ACT system evaluated without flap position as backup 
Probability of flight restriction 

2.J o_x 

1.73 X 10”^ 

Probability of flight diversion 

7.68 X 10"^ 

4.00 X 10"^ 

' ACT system evaluated without flap position and IRS 
as backup 

Probability of Full PAS loss 

3.11 X 10'^ 

1.73 X 10"^ 

Probability of flight restriction 

2.15 X 10"^ 

1.73 X 10"^ 

Probability of flight diversion 

7.68 X 10"^ 

4.00 X 10 

LAS single-channel operation 

Probability of function loss without 

3.62 X 10“^ 

2.93 xIO"® 

single-thread operation capability 
(baseline) 

3.55 X 10'® 

2.93 xIO"® 

Probability of function loss using 
servo output channel switching 




‘Selected System incorporates flap position as backup for DADC for gain scheduling, IRS pitch rate in 
Full PAS is backed up by four highly reliable pitch-rate instruments in crucial PAS, and LAS is per- 
mitted to degrade to single-channel operation. 


9. 2.2.2 Individual Function Reliability 

The ACT system individual function reliability requirements defined in the ground rules 
and this subsection have been met by the Selected System. Table 31 shows the individual 
ACT function reliability analysis results. The crucial ACT functions of Full PAS and 
inadvertent stick pusher operation show failure probabilities of less than 1 x 10 per 1-hr 
flight. All other individual function failure probabilities are also satisfactory. An 
assessment of the combined Baseline Airplane stick shaker and the ACT system AAL with 
stick pusher resulted in an essentially unchanged probability value. This is not an 
unexpected outcome, as both the stick shaker and the stick pusher actuators receive 
commands from the same computer and sensor combination. The probability that the 

_9 

stick pusher will not operate when required must also be less than 1x10 per 1-hr flight. 
The combination of probabilities that would result in this condition is (1) the 
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probability that the airplane is at an airspeed and aircraft attitude that represents 
incipient stall, (2) the probability that the stall warning system has failed or the flight 
crew does not act upon the stall warning, and (3) the probability that both stick pusher 
actuators fail to operate. This potential system failure probability is assessed as 
extremely remote. 

9.2.2.3 System and Function Reliability for Selected System 

A significant part of the analysis conducted on the Selected System addressed potential 
reliability improvements available from reconfiguration. The question of single-channel 
operation (single thread) in LAS was investigated because of the potential improvement in 
dispatch reliability if dispatch were to be permitted with one channel inoperative 
(subsec 9.2.3). Function failure probabilities for three computer and actuator 
configurations were assessed. First, the basic three-computer, two-actuator model 
requiring two operating channels was evaluated to establish a baseline. Next, the LAS 
function was modeled to evaluate single-thread operation by adding computer and sensor 
failure rates modified to evaluate covered as well as noncovered component failures. 
Coverage as used herein is the probability that the system will correctly detect a 
component failure and then successfully reconfigure the system. This became the 
Selected System. Finally, LAS was modeled to permit switching either computer servo 
output channel upon computer failure by incorporating a computer servo output logic and 
a switching circuit. Results of the single-channel operation study are presented in 
Table 32. As expected, the failure probabilities of the two computers hardwired to the 
actuators and the two actuator failure probabilities dominate the LAS function failure 
probability. The improvement in failure rate achieved by use of the servo output switch is 
tenfold. The full single-channel configuration is less than 18% better. Subsection 9.2.3 
discusses the benefits in dispatch reliability accruing from single-channel operation. 

Also investigated were the reliability improvements obtainable from providing backup 
sensor signals for the DADC outputs. Table 32 shows results of these studies. Probability 
of occurrence increased by 21% for flight restriction and 92% for flight diversion without 
flap position signals as backup inputs. With both the IRS pitch attitude and flap position 
signals deleted as backup inputs in the models, probabilities were calculated for the Full 
PAS function loss and for flight restriction and flight diversion. The Full PAS loss 
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probability increased by 79%, and the flight restriction probability increased by 24%. 
There was no change in flight diversion probability over the calculation without flap 
position signals as backup inputs alone, because the failure rate contribution of the IRS 
pitch attitude signal in this model is much smaller than either the DADC with flap 
position or primary computer failure rates. However, the results of these configuration 
studies verify the benefit of including backup signals for the major system sensors to 
attain lower flight schedule interruption rates. 

9.2.2.4 Assumptions of Reliability Analysis 

Because no adequate modeling technique was available to accommodate all logic 
complexities of ACT, the following simplifying assumptions were made: 

• Software reliability equals 1.0. 

e All circuits are verified serviceable prior to each flight. 

• Coverage in going from quadruple to triple and from triple to dual redundancy 
equals 1.0. 

Such assumptions are questionable in the design of crucial digital flight hardware. Boeing 
is collaborating with Raytheon to assess whether the computer-aided reliability estimates 
(CARE III) model could properly model digital computers driving highly complex, critical 
flight control systems. The Boeing fault tree model (vol. II, app B, sec B.2.0) can list and 
predict the independent probability of each minterm. It appears that this information can 
be used by CARE III to account for latent failures and degrading coverage, so Boeing is 
presently transferring the FTREE model to Raytheon to provide the input end of CARE 
III. If CARE III IS available during the next phase of the lAAC Project, this combined 
program may provide a more realistic prediction for the Selected System and for FBW 
modifications. At the present time, it appears that the Selected System will be able to 
meet the "extremely improbable" criterion for catastrophic failure because of the 
independent hardware and software provided by the Essential PAS backup function and 
because of the very short failure recovery time inherent in the Selected System 
architecture. This reinitialization capability should provide the answer to a large part of 
the transient hardware and software problems of present digital computers. Over 90% of 
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computer failures are not traceable to hardware defects (ref 7), and the impact of such 
interruptions on ACT operability can be avoided by rapid, automatic recovery from 
temporary faults. 

9.2.3 DISPATCH RELIABILITY 

The prediction of dispatch reliability (the probability that the airplane may be dispatched 
without delay in excess of 15 min) can be made by either of two methods; 

a. By an analysis based on the probability of a required ACT function being made 
inoperable by failure of a component 

b. By comparison to delay rates experienced in commercial service resulting from 
failure of components that are similar to the ACT components 

Although the FTREE program (vol. II, app B, sec B.2.0) can compute the probability as in 
item a (that an airplane would be in an undispatchable condition upon landing), the 
program cannot assess the impact of the time required to troubleshoot, repair, or replace; 
nor does it account for the different maintenance time available for a through-stop, a 
turnaround, or an overnight. All of these data and more are required to determine 
whether there will be a dispatch delay, and such data are not readily available. 

The second method requires extensive actual airline experience data on the number and 
duration of delays charged to particular components similar to ACT hardware in both 
function and minimum equipment list (MEL) requirements. The MEL identifies those 
components that can be inoperable without precluding dispatch. Previous experience has 
shown that only the second method provides accurate predictions, and it is therefore used 
here. 

A simplifying assumption used in the calculations was that if any component is part of a 
redundant set, not all of which is needed for dispatch, it does not contribute significantly 
to dispatch delays or cancellations. This is because the probability of two failures is so 
much lower than that of a single failure. These calculations cover only the increment in 
dispatch delays and cancellations produced by incorporation of the ACT system into the 
Baseline Airplane. 
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Table 33 shows the ACT component to be analyzed, then lists hardware, currently in 
airline service, chosen to approximate the ACT component and the airplane type in which 
it IS used and from which the actual delay and cancellation rates experienced were 
calculated. The following correction factors are used as indicated in the table: 

• Number per Airplane — The ratio of the number of components in the ACT airplane to 
the number of similar components in the airplane in service. 

• Flight Length Factor — The ratio of 1 hr, assumed as the ACT airplane duration, to 
the average flight duration of the inservice airplane. 

• Removal Rate Factor — The ratio of anticipated removal rate of an ACT component 
to the experienced removal rate of an inservice component. This value may be 
estimated by the ratio of failure rates. 

The sum of the interruption rates for each of the listed components represents the LRU 
total; i.e., the total interruptions traceable to the particular ACT LRUs. Experience has 
shown that the total airplane interruptions for an automatic flight control system are 
about 1.3 times as great as the sum of all interruptions traceable to particular LRUs 


Table 33. Tabular Solution to Dispatch Reliability 



A 

B 

C 

D 

E 

F 

G= AD 
E F 

H* B D 
E F 

J«CD 
E F 


Name of part added 
to (deleted from) 
Baseline Airplane 

Comparison part 
assigned serial 
numbers and 
part names 



Number 

per 

airplane 

factor 

Flight- 

length 

factor 

Removal 

rate 

factor 

ACT airplane 
(per 1000 departures) 

Remarks and MEL 
requirements 

Inter- 

ruptions 

Delay 

hours 

Cancel- 

lations 

Inter- 

ruptions 

Delay 

hours 

Cancel 

lations 

Primary ACT 

computers 

(three)® 

34-12-130-011 
Digital air data 
computer 


0 116 


00 

3/2 

0 58 

1 10 

1 

0 111 

0 093 

00 

Assumes no ME L 
dispatch for DADC 
or ACT Primary 
Computers 

Essential PAS 
computers (four) 

34-12-130-011 
Digital air data 
computer 


0 116 

0 097 

00 

4/2 

0 58 


0 081 

0 068 
1 


Assumes no MEL 
dispatch for DADC 
or Essential PAS 
Computers 

Elevator secondary 
actuators (three) 

27-31-675-051 
Elevator PCU 

747 

0 0277 



3/4 



0 007 



No MEL dispatch 

WLA primary 
actuators (two) 

27-11-675-011 
Aileron actuator 

747 




2/4 


1 0 

0 004 

0 008 

0 003 

No MEL dispatch 

Elevator PCUs 
(two) 

27-31 675-051 
Elevator PCU 

747 


0 095 


2/4 

0 36 

091 

(0 005} 
(Negative 

(0 016) 
Negative 


Net reduction 

ACT hydraulic 
lines 

27-21-280-191 

Rudder 

hydraulic lines 

727 

0 0021 

0 0094 

00 

4/1 

1 0 

1 0 

0 008 

0 038 

00 

No MEL dispatch 

DADC on ACT 
(three)^ 

34-12-130-011 
Digital air data 
computer 

DC-10 

0 116 

0 097 

00 

3/2 

0 58 

1 0 

0 101 

0 084 

00 

No MEL dispatch*^ 


LAS function is configured for single-thread operation, it is possible to dispatch with one primary computer inoperative 
^hen DAOC is backed up with pitch angle and flap position, it is possible to dispatch with one DAOC inoperative 
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because of interface problems. Therefore, the ACT system totals are computed as 1.3 
times the LRU totals. 

Delay and cancellation rates are significantly impacted by the following hardware options: 

• Pitch Angle and Flap Position Signals Substitute for DADC— With this system 
configuration, dispatch is allowed with one DADC failed. 

• Single-Thread Operation of LAS — Because single-thread LAS is allowed under flight 
restrictions, dispatch is possible with one primary computer failed. This implies the 
possible need to exchange primary computer positions during preflight preparation, 
and this is considered acceptable. 

Three combinations of the preceding options for the Selected System were evaluated. The 
results are shown in Table 34 and compared with similar versions of the Integrated System 
and Segregated System dispatch reliability. Figures in parentheses show the interruptions, 
delay hours, and cancellations as a percentage of those of the basic Selected System 
without the beneficial impact of such additional dissimilar redundancy. The delay rate 
allowed under the design requirements and objectives (DRO) for the Baseline Airplane was 
1.3%. The ACT system is not to add more than 5% to that. Thus, the allowable limit is 
0.65 delays per thousand departures (5% of 1.3% of 1000). All combinations shown in 
Table 34 fall below this limit. 

Data presented for interruptions and delay hours show that the Segregated System has the 
lowest schedule interruption times. This reflects the fact that most delays, like 
diversions, result from a fault that would cause a combination of ACT functions to be 
inoperable. The Segregated System, with different computers for each ACT function, is 
less prone to simultaneous component failures than the other systems. The smaller 
difference between the Integrated and the Selected System delays results from using four 
high-reliability dedicated pitch-rate sensors in short-period PAS instead of inputs from 
the IRSs. 

The Selected System has an important advantage over the Integrated System that cannot 
be quantified because of lack of comparable commercial transport experience. It is 
anticipated that rigorous retest will be required after any maintenance work on any 
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Table 34. Predicted Delay Rates 


Systems and assumptions 

Per 1000 departures 

LRU totals 

System totals (LRU total x 1.3) 

Interruptions 

Delay hours 

Cancellations 

Interruptions 

Delay hours 

Cancellations 

Basic Selected System but: 

• No DADC backup 

• No single-thread LAS* 

0.307 

(100%) 

0.298 

(100%) 

0.003 

(100%) 

0.399 

(100%) 

0.387 

(100%) 

0.009 

(100%) 

Selected System 
•With DADC backup 
• No single-thread LAS 

0.206 

(67%) 

0.214 

(72%) 

0.003 

(100%) 

0.268 

(67%) 

0.278 

(72%) 

0.004 

(100%) 

Selected System 

• With DADC backup 

• With single-thread LAS** 

0.095 

(31%) 

0.121 

(41%) 

0.003 

(100%) 

0.124 

(31%) 

0.157 

(41%) 

0.004 

(100%) 

Integrated System 
•With DADC backup 
• No single-thread LAS 

0.292 

(95%) 

0.265 

(89%) 


0.380 

(95%) 

0.344 

(89%) 

0.0072 

183% 

Segregated System 
•With DADC backup 
•No single-thread LAS 

0.122 

(40%) 

0.128 

(43%) 


0.159 

(40%) 

0.167 

(43%) 

0.0072 

183% 

Limit underDRO 

0.5 

- 

- 

0.65 

- 

- 


* Figures in parentheses show the interruption, delay, or 
cancellation rates as a percentage of those for the basic 
Selected System that has no DADC backup and no single- 
thread LAS. 

**The Selected System with DADC backup and with single- 
thread LAS was used in calculations of cost of ownership. 


portion of the crucial short-period PAS system. Because the Integrated System shares 
computers and pitch-rate sources between the crucial and critical systems, it is probable 
that any maintenance or removal of the computers or IRSs resulting from other ACT 
function maintainance would also require this time-consuming retest. The Selected 
System should avoid this penalty. 
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9.3 COST OF OWNERSHIP 


Cost-of-ownership analysis predicts the incremental return on investment (ROI) that may 
be expected by the airlines for the Integrated, Segregated, and Selected Systems. This 
analysis enables present dollar values per flight hour to be calculated for economic 
parameters such as fuel cost saving, maintenance cost, spares inventory cost, and system 
purchase cost. This avoids the need for intuitive weighting factors (previously inherent in 
trade matrices) and removes subjective judgment from the design decision process. The 
ACT functions considered in this analysis were PAS, LAS, WLA, FMC, and AAL. 
Flaperons were not included in WLA. 

9.3.1 COST-OF-OWNERSHIP MODEL 

The Boeing-developed airline cost-estimating system (ACES) computer program was used 
in this analysis. For each future year, this program calculates the airline profit or loss 
that may be expected from the add-on ACT, then calculates the ROI to the airline based 
on the present equivalent value method. ACES considers the expected inflation rate, 
investment tax credit, depreciation credit, income tax, operating cost, etc., and shows 
parameters that have the greatest impact on ROI. It also establishes the payback point 
after which a positive cash flow (profit) to the airline may be expected. 

9.3.2 COST-OF-OWNERSHIP ANALYSIS ASSUMPTIONS 

The economic analysis is based on the following cost-of-ownership ground rules that are 
consistent with those used by Boeing for in-house studies on aircraft of similar size: 

• Fleet size = 30 aircraft 

• Airplane production run = 300 airplanes 

• Minimum attractive ROI = 15% 

• Tax depreciation life =10 years 

• Fleet life =15 years 

• Investment tax credit = 10% 

• Cost per delay hour = $1400 

• Cost per cancellation = $5100 

• Spares holding cost = 10% of spares cost 
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• Yearly utilization = 3000 hr 

• Average trip = 1.25 flight hours and 863 km (466 nmi) 

• Yearly general inflation rate = 10%; yearly fuel inflation rate = 15% 

• Insurance = 1% of purchase cost 

• All costs in 1978 dollars 

9.3.3 COST-OF-OWNERSHIP PARAMETERS 

Table 35 shows the cost-of-ownership parameters used to calculate ROI to the airline. 
The calculated ROI and years to payback are also shown. These data are based on the 
ACT system configurations described in this document, except that flaperons are not 
included. This simplification was necessary to enable using the Initial ACT weight, drag, 
and fuel burn predictions when evaluating the configurations described herein (see ref 2). 


Table 35. Cost-of -Ownership Results for Various ACT Systems 


Parameter incremented 

ACT technology base 

Integrated 

Segregated 

Selected 

Selected, 
pitch FBW 

Aircraft purchase cost per aircraft 

$274 000 

$390 200 

$297 100 

$207 000 

Maintenance manual cost per 
30-airplane fleet 

$21 000 

$31 400 

$26 100 

$26 100 

Test equipment cost per 
30-airplane fleet 

$22 500 

$44 900 

$33 600 

$33 600 

Spare inventory initial cost per 
30-airplane fleet 

$250 000 

$356 000 

$271 100 

$271 100 

Maintenance cost per aircraft 
flight hour 

$4.18 

$4.91 

$4.22 

$3.98 

Departure delay and cancellation 
cost per aircraft flight hour 

$0.54 

$0.45 

$0.19 

$0.12 

Change in system weight 
relative to Integrated System 

0 

+114 kg 
(+252 lb) 

+14 kg 
(+30 lb) 

-157 kg 
(-345 lb) 

Fuel saving per flight hour at 
863 km (466 nmi) 

160 kg 
(352 lb) 

146 kg 
(322 lb) 

160 kg 
(352 lb) 

172 kg 
(379 lb) 

Payback period in years 

2.83 

4.14 

2.98 

2.02 

Incremental return on investment to airline 

25.1% 

22.1% 

24.6% 

27.6%* 


*Assumes 1985 introduction with fuel cost of $0,555/8 ($2.10/gal) and that fuel cost inflates 
at 15% per year against a general inflation rate of 10% per year. 
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Significant variations in cost-of-ownership parameters among ACT systems are discussed 

in the following items. 

• Incremental Aircraft Purchase Cost— The Segregated System showed the highest cost 
because of the 21 small segregated computers used as compared with the 4 larger 
computers in the Integrated System. The Selected System cost is higher than the 
Integrated System cost because of four additional small computers and three extra 
dedicated pitch-rate sensors used to provide the standby, independently redundant, 
short-period PAS system. The Selected System with FBW in the pitch axis was the 
lowest in incremental cost because of the high parts count of the mechanical pitch 
signaling system, which was deleted. The parts deleted included the elevator feel 
mechanism, elevator pressure control modules, elevator feel computer, cables, bell 
cranks, push rods, pulleys, etc. 

• Maintenance Manual Cost for 30-Airplane Fleet— This parameter was based on 
typical autopilot cost prorated for increasing electronic complexity. Thus, the 
Segregated System cost is the highest. 

• Incremental Test Equipment Cost for 30-Airplane Fleet — This assumed that the 
airline would already possess the basic digital test equipment for the remainder of 
the digital electronic suite. Cost increment thus was based on the cost of additional 
adapters and test software required for ACT. The more electronically complex the 
ACT system, the greater the cost. 

• Incremental Spares Inventory Initial Purchase Cost per 30-Airplane Fleet — This 
parameter was affected primarily by the higher cost, higher-removal-rate electronic 
equipment. The Segregated System cost was highest and the Selected System was 
next. 

• Maintenance Cost per Flight Hour — This was calculated based on past experience and 
recent predictions at the significant LRU level. As expected, the 21 -computer 
Segregated System cost was highest. The cost of the Selected System with pitch 
FBW was lowest because of the removal of elevator mechanical controls. The 
additional maintenance cost for ACT is less than that for a current autopilot 
system. This is because rate gyros, which account for up to 70% of maintenance 
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cost of current systems, are eliminated, and vertical reference and rate data are 
provided by the IRS. 

• Incremental Delay and Cancellation Cost per Flight Hour — Integrated System cost 
was highest because the loss of a single flight control computer or IRS prevented 
dispatch. The Segregated System showed some improvement because of the 
separation of functions and the adoption of the four reliable, dedicated pitch-rate 
sensors for the short-period PAS function. Hence, the aircraft could now dispatch 
with one IRS down. The Selected System with pitch FBW shows the lowest delay and 
cancellation cost because of the adoption of the flap position switch to back up the 
DADCs for the speed PAS function and the removal of the mechanical connections, 
feel computer, etc., between the pilot's control column and the elevator. 

• ACT System Weight and Fuel Saving— Detailed performance data were derived only 
for the Initial ACT Integrated System because the aircraft of the later systems 
remained externally the same and used the same active control surfaces. Thus, only 
ACT system weight relative to the Integrated System would impact block fuel. The 
weight delta for the Selected System had an insignificant impact on fuel burn, but 
fuel savings for weight changes in the Segregated System and Selected System with 
pitch FBW were adjusted as indicated. The weight penalty for the Segregated 
System derived from its 21 computers and the addition of an extra battery to supply 

' emergency dc power. The weight saving for the Selected System with pitch FBW 
resulted from deletion of mechanical components in the elevator pitch controls. 

• Payback Period and Incremental ROl -The payback period for all systems was short, 
as desired, and the ROI to the airline exceeded the 15% minimum attractive rate of 
return established for this study. The ROIs shown in Table 35 are based on a service 
entry date of 1985 and assume that fuel inflates at 15% per year and other cost-of- 
ownership cost parameters inflate at 10% per year. The 1985 starting fuel price 
used was $0.555/£ ($2. 10/gal), and all dollars are 1978 dollars to keep the present 
studies in line with the Initial ACT ROI reported in Reference 2. ROI is highly 
dependent on the relationship between average yearly fuel inflation rate and the 
inflation rates of aircraft cost, maintenance cost, etc. This is shown in Figure 115, 
where the fuel yearly inflation rate is varied between 15% and 25% while 
maintaining other inflation rates at 10%. It is apparent that ROIs much greater 
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Figure 1 15. Return on Investment Versus Inflation Rate of Fuel 


than those shown in Table 35 will be obtained if historical (since 1972) average 
annual fuel inflation rates persist into the future. 

Figure 116 plots ROl against years to payback for the various ACT systems. Given equal 
technical risk for these current technology systems, the least financial risk will be 
provided by the system that gives the shortest payback period and the highest ROI; 
namely, the Selected System with pitch FBW at 2.02 years and 27.6% ROI. 
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Figure 1 16. Time Required To Pay Back ACT Investment 

9.3.4 HIGH-LEVERAGE COST-OF-OWNERSHIP PARAMETERS 

Figure 117 shows the impact on incremental ROI of varying the incremental aircraft price 
and the fuel savings or fuel cost by 50% above and below nominal. It is apparent that the 
highest leverage exists for decreases in fuel cost and incremental aircraft cost. 

9.3.5 COST-OF-OWNERSHIP CONCLUSIONS 

The incremental ROI and the short payback period obtainable from the active control 
systems studied make them a highly attractive investment at expected fuel-price inflation 
rates. 
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Figure 1 17. Effect of Changes in Cost Parameters on Incremental Return on 
Investment 

It should be noted that the preceding statement applies to the Integrated, Segregated, and 
Selected Systems as a whole, because no attempt has yet been made to assess the 
incremental ROI for individual functions. Thus, it has been shown (ref 2) that PAS, by 
permitting a reduction in horizontal stabilizer area (weight and drag), accounts for about 
90% of the reduction in fuel burn. Whether the addition of FMC and WLA would 
be cost effective has not yet been established. However, if they are not cost effective 
and therefore are excluded from the Initial ACT Configuration, the ROIs of the various 
systems can only increase. 


Advanced technology studies indicate that FBW in all axes is highly cost effective. From 
this it can be concluded that if total FBW is adopted, most active control functions that 
may prove necessary can be provided at minimum additional cost. 
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10.0 ADVANCED TECHNOLOGY TASK OVERVIEW 


The overall objective of the work performed under the advanced technology task was to 
define advanced control systems for future commercial transports. It is part of the 
Integrated Application of Active Controls (lAAC) Technology to an Advanced Subsonic 
Transport Project, which is one element of NASA's Energy Efficient Transport (EET) 
Program. Figure 118 shows the Advanced Technology ACT Control System Definition 
Task breakdown. The work consisted of two tasks: Advanced System Trade Studies and 
Implementation Alternatives. The combined output from these two tasks constituted 
definition of representative advanced control systems. 


The objectives of the Advanced System Trade Studies were to develop control law analysis 
and synthesis methods suitable for coupled multiloop systems and to demonstrate the 



Figure 1 18. Advanced Technology Control System Task Breakdown 
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potential benefits of these by evaluating the closed-loop performance of a set of control 
laws. Gust-load alleviation (GLA), flutter-mode control (FMC), and rigid-body pitch 
stability and command augmentation control laws were synthesized. The methods 
employed were based on modern optimal control and estimation theory. 

The GLA and FMC control law performance was evaluated based on wing-load and control 
surface responses to continuous random vertical turbulence, discrete vertical gusts, and 
control loop stability margins. The pitch augmentation control laws were evaluated based 
on pitch-rate and load factor responses to elevator commands. 

The technical approach for the control law synthesis and performance evaluation is 
summarized in Section 11.0 and described in more detail in Volume 11, Appendix E. The 
GLA and FMC control laws and the corresponding results from the performance analyses 
are summarized in Section 12,0, with a more extensive collection of performance data 
presented in Volume II, Appendix F. The pitch augmentation control laws and the results 
of the performance evaluations are presented in Section 13.0. 

The objective of the Implementation Alternatives work was to identify advanced system 
alternatives to the current technology implementation. The total control system, 
including sensors, computers, servos, actuators, and data transmission, was considered. 
The work comprised two major tasks. First, sensors, computers, servos, actuators, and 
data transmission technology that might be expected to be available for a circa 1990 
commercial airplane were projected. Second, the corresponding flight control system 
architecture system provides the same functions as the current technology system and 
was designed to provide improved performance and reliability with cost of ownership 
equal to or better than the conventional system. Alternative implementation is described 
in Section 14.0, with more details provided in Volume II, Appendix G, 
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11.0 ADVANCED TECHNOLOGY CONTROL LAW SYNTHESIS 
AND ANALYSIS METHODS 


The following subsections summarize the technical approach used for control law 
synthesis and open-loop and closed-loop performance evaluations. Volume II, Appendix E, 
contains a more detailed description. 

The complexity of the control task and the dynamic characteristics of a typical flexible 
transport airplane dictate the solution of a coupled multiloop control problem. The 
classical approach of synthesizing one loop at a time is not well suited to deal directly and 
efficiently with coupled multiloop systems or to take advantage of favorable interactions 
between the control loops. 

The design was accomplished using a set of experimental computer programs on the CDC 
6600 system. These programs are particularly suited for the analysis and synthesis of 
multivariable controllers for Active Controls Technology (ACT) airplanes and are based on 
time-domain modern control theory. Key elements are state-space representation of 
dynamic systems, modal analysis, and optimal control and observer synthesis. Figure 119 
indicates the design process flow. The main elements are model generation, linear 
analysis, optimal controller design, and simulation. 



Figure 1 19. Control Design Procedure 
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11.1 DYNAMIC MODELS 


The control Jaw synthesis and analysis require models of the flexible airplane, measure- 
ments and performance parameters, actuation system, and wind disturbances. These 
models are connected to perform open-loop analysis, control law synthesis, and, when 
combined with a control law, closed-loop performance evaluation. 

11.1.1 FLEXIBLE AIRPLANE MODEL 

The airplane at each flight condition is represented by a set of constant coefficient linear 
second-order differential equations modified by the addition of first-order lag terms. 
Figure 120 is a corresponding block diagram description, with blocks representing the 
steady and unsteady aerodynamic forces and the structural model. This diagram graph- 
ically describes how the model is put together in the computer using an automated 
model generation program. After the input-to-output relations of each block and the 
block connections are specified, a precompiler program generates Fortran subroutines 
that are combined to represent the complete model in program form. The individual 
blocks may represent nonlinear relationships. These models are used to perform static 
trim calculations, conduct simulations, and generate linear state models at specified 
operating points. These particular formulations produce a well-structured state vector 
consisting of q(t), the rigid and elastic modal coordinates; q(t), the corresponding rates; 

and w (t), the unsteady aerodynamic states due to wind. 

S 

In modeling the airplane, an approximate transformation from frequency- to time-domain 
representations of the unsteady aerodynamic forces, except for forces due to gusts, is 
accomplished with a least-square fit of a second-order polynomial in the Laplace variable 
s, resulting in steady and unsteady aerodynamic forces as functions of displacements and 
the corresponding first- and second-order time derivatives. The unsteady effects 
associated with gust inputs are approximated with Kussner lift-growth functions. The 
outputs of these become states of the system. The state model of the flexible airplane 
takes the form 


d d ci d ^ o 


( 1 ) 
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Figure 120. Model of the Flexible Airplane 


where 


X (t) = 
a 


q(t)' 

■wgVt) 


is the airplane state vector, u(t) is the control vector, and w (t) is the gust velocity input 

S 


vector. 
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1 1 . 1 .2 OUTPUT MODEL 


The needed outputs are the displacements, velocities, accelerations, and loads at various 
stations on the airframe. The first three items are related to the modal coordinates, q(t), 
and the mode shape matrix, 0. 

The displacement, velocity, and acceleration measurements and the loads are all 
expressed in a general form of the state model output equation 

y(t) = C X (t) + D u(t) + E-W (t) (2) 

ad d “ K 

where y(t) is a vector of measurements and loads. The detailed development of the output 
equations is shown in Volume II, Appendix E, Subsection E.1.3. 


n.1.3 ACTUATOR MODEL 


Only linear actuator models have been considered in this study. They are expressed as 
state models in the standard controllable form 


^6 = 


“ 0 1 

...0 “ 


-Q - 

0 0 

...0 

\g (t) + 

0 

• • 

« • 

• • 

1 

1 


L-ao-^1 



a 

n- 1 


L 0 J 


(3) 


where 6^ (t) is the ith control surface command, 6j(t) is the ith control surface position, 

X 5 -(t) is the state vector of the actuator, and a^, a^ ... , a^_j are the coefficients of 
the actuator transfer function. 


The general form of the model for the complete actuation system is 


u(t) = C^x^(t) 

where x^ is the state vector for all actuators, u^(t) is the command vector for all 
actuators, and u(t) is the control vector for all surfaces. 


(4) 

(5) 
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11.1.4 WIND MODEL 


Because of its simplicity, the Dryden turbulence model for vertical gusts was selected to 
represent gust disturbances. In state variable form this becomes 



( 6 ) 


w^(.) 


C X (t) 
w w' ' 


(7) 


where x is the wind state vector, w (t) is a white noise input vector, and w„(t) is the 
w ’ c g 

vector of vertical gust velocities at various airframe stations. The input is white noise, 
and the outputs are correlated gust velocities having the Dryden power spectral density. 

11.2 MODAL ANALYSIS 

The stability and response characteristics of a linear aeroelastic system represented by a 
state model are completely described by the associated eigenvalues, eigenvectors, and the 
input and output distribution matrices. From Subsection 11.1, the state model general 
form is 


x(t).= Ax(t) + Bu(t) + r w (t) 

s 

(8) 

y(t) = Cx(t) + Du(t) + Ew (t) 

g 

(9) 


The eigenvalues of the system are the values of (i = l,n) that satisfy the equation 
det(Xl-A) = 0 

where I is the identity matrix and det(-) means the determinant of the argument. 

The eigenvectors Vj (i = l,n) of the system are defined by the relation 
AVj =XjVj (i = l,n) 
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If X. is a complex eigenvalue, then the corresponding eigenvector Vj is also complex. 
Because the state matrix A is real, it can be shown that complex eigenvalues and 
eigenvectors always occur in conjugate pairs. The complete eigensystem consists of n 
eigenvalues and the corresponding n eigenvectors. 

It can be shown that there exists a similarity transformation 
x(t) = Tz(t) 

such that the preceding system of equations can be reduced to block diagonal form in 
terms of the modal coordinate vector z(t): 

z(t) = (T"^M)z(t) + (T‘‘B)u(t) +(T‘^ Dw (t) (10) 

O 

y(t) = (CT)z(t) + Du(t) + Ew (t) (11) 

11.3 RESPONSE CALCULATIONS 
11.3.1 COVARIANCE ANALYSIS 

The frequency-domain power-spectral-density technique has been widely used to compute 
steady-state gust responses. This requires determination of a complex frequency response 
matrix relating gust -velocity inputs to output response variables and computation and 
integration of a large number of power and cross spectra. For a flexible airplane with a 
large number of lightly damped modes that are subjected to distributed random-gust 
inputs, these calculations may be costly and inaccurate. In this work, this technique has 
only been used to compute the output power spectral density for a limited number of 
parameters. For most gust response calculations, the total root-mean-square (rms) 
responses are of primary interest. These are obtained by using a new approach for 
computing the steady-state response correlation matrices of a dynamic system subjected 
to random inputs. This method avoids the computational difficulties and inaccuracies 
associated with lightly damped modes, with approximate gust penetration effects, and 
with the finite frequency range of integration. The calculations are performed using 
time-domain state-space representation of the airplane model. A transformed covariance 
matrix is obtained by computation of convolution integrals. The values of the integrals 
can be evaluated in closed form for white and Dryden spectra, among others. Gust 
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penetration effects as the airplane traverses the field of atmospheric turbulence are 
modeled by pure time delays, avoiding the use of Fade approximations. The algorithm 
computes the steady-state gust response correlation matrices for the states and outputs 
and the corresponding rates with the state model in block diagonal form. 

11.3.2 LINEAR SIMULATION 

Simulations are performed using a block diagonal discrete-time state transition model. 
This model is derived from continuous-time state variable form 

x(t) = Ax(t) + Bu(t) (12) 

y(t) = Cx(t) + Du(t) (13) 

where y(t) is the vector of output response variables, and the state vector x(t) consists of 
the rigid and flexible airplane modes, actuator states, and controller states. The elements 
of the input vector, u(t), are the pilot commands and gust inputs. 

The system represented by these equations is transformed to block diagonal form using 
the similarity transformation as described in Subsection 11.2. Assuming a constant value 
for input u(t) over an interval t to t + At, the transition of the system model response in 
that time interval can be expressed as 

z(t + At) = 0z(t) + Ou* (14) 

where u* is a value of u(t) in the interval [t, t + Atj , 0 is the modal state transition 

matrix, and 6 is the integral of the modal state transition matrix over the interval 
[t, t + At] multiplied by the modal input distributions matrix B. The output vector is 
expressed as 

y(t) = C'z(t) + Du* (15) 


If the responses of the original state vector x(t) are required, they are simply included in 
the output vector. For an nth-order system, the total number of operations required at 
each integration step is at most 2n multiplications and additions plus n multiplications and 
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2 

additions for each input. This compares with n and n, respectively, for a system that is 
not block diagonalized. For high-order systems where the number of states is 
substantially higher than the number of outputs, there is a significant reduction in the 
computational time. 


11. MODEL REDUCTION 

The open-loop dynamic model of a flexible airplane must be simplified before the design 
of a practical controller. Also, any high-order Kalman filter that has been synthesized 
based on either a full-order or reduced-order open-loop model must, in most cases, be 
simplified before it is implemented in the flight computers. In both cases, the purpose is 
to reduce the order to a level consistent with computational capabilities while preserving 
the significant dynamic characteristics relative to the control objectives. Many 
techniques are available, but none will consistently produce accurate and meaningful 
results without a good understanding of the inherent physical relations behind the control 
task. The most suitable approach to the design of a low-order controller has not been 
resolved in this work. However, two methods and their particular application will be 
described. 

1 1.4.1 DELETION OF NONESSENTIAL STATES 

Figure 121 illustrates this method. The dynamic model is reduced in size by deleting rows 
and columns from the state model matrices. If the full model is of order n, and m states 
are deleted, the reduced model is of order n - m. This method is suitable for deleting 
nonessential states, such as airplane rigid-body displacement states that do not produce 
forces and moments or states associated with weakly coupled modes. For example, the 
phugoid mode can be eliminated from the model with insignificant impact on the 
remaining short-period and structural modes by deleting the forward velocity and pitch 
angle states. 

11.4.2 MODAL RESIDUALIZATION 

This method for model reduction is suitable for systems that include fast dynamics that 
are not significant with respect to the control task or that have uncontrollable or 
unobservable modes. This is typical for flexible airplanes that may have a large number 
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Figure 121.'. Deletion of Nonessential States 


of stable high-frequency modes and a number of weakly controllable or weakly observable 
modes. The high-frequency modes are generally not modeled very accurately and in most 
cases need not be controlled to meet the closed-loop design objectives, except that the 
control loop gain at high frequency must be sufficiently low so as not to destabilize any 
high-frequency mode. 

The flexible airplane is represented by a linear time-invariant system described by 
equations (10) and (11) in modal form. The state model is partitioned into two sets of 
modes, Zj(t) and Z 2 (t), as shown in Figure 122. Having ordered the modes so that the 
upper partition contains low-frequency modes and all unstable modes and the lower 
partition contains high-frequency stable modes, it is assumed that the modes Z 2 (t) respond 
much faster than the modes z^(t) and that only the dynamics of Zj(t) are important with 
respect to the control task. If Z 2 (t) consists of i modes, the original nth-order system has 
been reduced to an (n - i)th-order system. The eigenvalues of the system are simply those 
of the retained modes, and the controllability and observability of these are unchanged 
from the original full-order model. The steady-state effects from the deleted modes z^it) 
are included in the outputs y(t) through additional input terms. 
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• Full-order model (in block diagonal form) 



• Assumption: 

Z2 ci 0 

• Reduced-order model' 

z-j = A^2^ -rB'^u + r'-jWg 

Z 2 ~ ~^2 ^ 2^ ~ ^2 ^ 2^^g 

y = C'i z^ + (Dg - C' 2 A 2 ^ B' 2 )u -t ( Eg - C' 2 A 2 ^ r' 2 ^ '^g 

Figure 122. Modal Residualization 


1 1 .4.3 LEAST-SQUARE ERROR MINIMIZATION 

This method is used to approximate the frequency response characteristics of a low-order 
system to that of a high-order system. The technique is based on curve-fitting single-loop 
frequency responses against a specified model system over a finite range of frequencies. 
For example, suppose it is desired to approximate the ijth control loop transfer functions 
G(s) using a low-order model with transfer function G(s,p). The vector p contains the 
parameters of the low-order system. A fit error function, E(p), is defined as the integral 
of the squared error between the actual system and the modeled system. The transfer 
function parameters p are determined from the minimization of this error function. This 
is accomplished by a modified conjugate gradient search to minimize the error function. 
Constraints are imposed on the parameters to ensure consistent phase and gain 
characteristics and to maintain stability requirements. 

This procedure can be applied to integrate filters of different order. It is achieved by 
curve-fitting the filter frequency responses at different design points with a common 
filter form whose parameters are scheduled as a function of flight condition. 
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11.5 OPEN-LOOP ANALYSIS 


For the open-loop analysis, state models of the airplane and actuation systems are needed. 
All models are full order except for the deletion of nonessential states. These two models 
are combined and are expressed in the form 

x(t) = A^x(t) + B^u^(t) +r Wg(t) (16) 

y(t) = C^x(t) + Wg(t) (17) 

where the matrices and vectors are defined in Volume II, Appendix E, Subsection E.5.1. 

1 1.5. 1 OPEN-LOOP STABILITY 

The stability of the airplane rigid and flexible modes is determined by computing the 
eigenvalues of the dynamic models. This is done for several flight conditions and airplane 
mass distributions. The effect of selected parameters, such as dynamic pressure, altitude, 
or true airspeed, is evaluated by determining the range of values for which the system is 
stable. 

1 1 .5.2 OPEN-LOOP RESPONSE 

For flight conditions at which the open-loop airplane is stable, the steady-state gust 
response correlation matrices for the state, modal state, measurements and performance 
parameters (such as bending moments, torsional moments, accelerations, etc.), and the 
output power spectra of selected performance parameters are computed. The transient 
responses due to discrete gusts and elevator commands are obtained by simulations. 
Because the load equations are based on a truncated set of modal coordinates, the 
absolute magnitudes of the loads are not correct. However, because all modes that are 
significant with respect to the control task are included, these approximate load 
calculations are sufficient for evaluating the relative merits of various control laws. 

For the various correlation matrices, the diagonal elements represent the variances of the 
gust response and the offdiagonal elements represent the cross-variances of the gust 
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response. The output power spectral density of selected gust loads is used to determine 
the significant frequency content. 

11.5.3 CONTROLLABILITY 

The initial open-loop airplane model contains a selection of several possible control 
surfaces that may be suitable for the control task. One or more of these will be selected 
for the final design. Two criteria are used in this selection process: mode controllability 
and performance parameter controllability. 

The relative controllability of a given mode by the various elements of the control vector 
can be obtained by transforming the state equations into block diagonal form and by 
appropriate scaling of the control vector. 

Inspection of the columns of the transformed control matrix 

B' = T’^B T 
o o u 

will show the coupling of each control into the various modes. T^ is a diagonal scaling 
matrix with elements corresponding to the maximum allowable control deflections. To 
assess the relative effectiveness of the controls in controlling a particular mode, it is 
necessary only to examine the corresponding row (or two rows, if the mode is oscillatory) 
of the matrix B'^. The column with the largest absolute value will identify the most 
effective control. 

The concern is also with control of certain performance parameters such as bending 

moments, torsional moments, accelerations, etc., at various airplane stations. These are 

represented by the state model output equation (17). The relative controllability of these 

can be assessed by computing the steady-state output response correlation matrices given 

an appropriately scaled white noise input at the individual control actuators. Consider the 

state model given by equation (16) with a single input u (t) where u (t) is a scalar input 

*^i ‘^i 

corresponding to the ith control and is stationary white noise with intensity corresponding 
to the appropriate element in the matrix T^. 
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The steady-state response correlation matrix is computed for the output vector y(t), 
equation (17). This is repeated for all control inputs (t) (i = l,m). For given 

performance parameter yj(t), there will be a set of m variances (one for each control) 

Vjjli = limE[y.(t)yj(t)]|. (i = l,m) 


where m is the number of controls. The most effective control, u (t), with respect to the 

‘'i 

performance parameter, yj(t), is identified by the largest variance I j. The mode 


controllability and performance parameter controllability described previously only assess 
relative effectiveness and do not guarantee that the selected controls are adequate to 
perform the control task. However, evaluating the closed-loop control surface responses 
of a full-state design will determine whether or not a given choice of controls is adequate 
for the control task. 


11.5.4 OBSERVABILITY 


The initial open-loop model contains measurement equations for sensors placed at a 
number of possible locations. One or more of these will be selected for the final design. 
Two criteria are used for this selection: mode observability and performance parameter 
observability. 

The relative observability of the rigid and flexible modes from measurements at the 
various airplane stations can be obtained by transforming equation (17) into block diagonal 
form. Consider a set of like measurements, y(t) at all possible sensor locations, and 
expressed in terms of the block diagonal coordinate, z(t), as 

y(t) C Jz(t) + Wg(t) (18) 

Inspection of the columns of the transformed measurement matrix 


shows the relative observability of the system modes from measurements at the various 
locations. The row containing the largest absolute value identifies the most suitable 
location for that particular type of sensor. 
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The concern is also with the observation of certain performance parameters, such as 
bending moments, torsional moments, accelerations, etc., that are excited by the random- 
gust inputs but that cannot be measured directly. Consider the state model represented 
by equations (16) and (17). In this case the output vector, y(t), consists of various 
performance parameters that are not directly measurable, as well as a set of measure- 
ments at all possible sensor locations. The steady-state gust response correlation matrix 
for the complete output vector, y(t), is computed. For a given performance parameter, 
y^(t), a set of p cross-variances is obtained 

V^. = hmE[y.(t)y^(t)J (i = l,p) 

where p is the number of sensor locations. The most suitable sensor location is identified 
by the largest absolute value of the cross-variance V... For a given performance, 
magnitudes of the cross-variances depend on the correlation between y^(t) and the 
measurement y^(t) and the magnitude of the measurement variance V... Thus, using the 
magnitude of the cross-variance as a basis for sensor selection ensures the best 
combination of sensor-to-performance criteria correlation, as well as sensor output 
signal-to-noise ratio. 


11.6 CONTROL LAW SYNTHESIS 

Control law synthesis consists of formulation of a linear small-perturbation state model 
for synthesis, modified linear quadratic regulator design, modified Kalman state estimator 
design, and controller simplification. The first three items have been addressed 
extensively during this study and will be described here in some detail. Controller 
simplification will be the subject of future work; however, a general approach will be 
described here. 

The state model for control law synthesis comprises the airplane dynamic model, 
actuation system model, and the wind disturbance model and is expressed by 

x(t) = A x(t) + B u (t) + r w (t) + B d(t) 
y(t) = C^x(t) + F v(t) 


318 



where the matrices and vectors are defined in Volume II, Appendix E, Subsection E.6.I. 
This model represents the dynamic characteristics of the airplane for small-perturbation 
motion around a trim point. In the absence of external disturbances, the airplane is in 
steady unaccelerated flight at the trim point. 

The linear regulator provides optimum closed-loop response with respect to release from 
initial conditions and with respect to random input disturbances that have a flat power 
spectrum over the range of frequencies characteristic of the airplane. The power 
spectrum of turbulence is not flat over the range of rigid and structural mode frequencies 
of a transport airplane. Thus, it is necessary to augment the synthesis model with a model 
of the atmosphere that has white noise as inputs and the gust velocities with the desired 
power spectra as outputs. This implies that for an optimal gust-load alleviation (GLA) 
control law, it is necessary to feed back the gust states. These states are observable from 
acceleration sensors. 

11.6.1 LINEAR REGULATOR DESIGN 

The application of optimal control theory furnishes direct synthesis of the structure and 
gains of a control law. Optimal control is based on the minimization of a cost functional, 
subjected to the constraints of the equations of motion. To meet the closed-loop 
requirements of an active control transport, three methods have been adopted for directly 
incorporating specific design criteria in the optimal control law synthesis. The first 
method is the usual quadratic cost penalty on specific performance criteria such as 
deflection, velocity, acceleration, or load. The second method is implicit model- 
following, which is used to structure the cost function so that the dynamic response of the 
closed-loop system approaches that of the model. This is a suitable method for 
incorporating handling qualities criteria or other transient and steady-state response 
specifications. The third method is specification of a minimum degree of stability. This 
will ensure that all closed-loop eigenvalues will be placed to the left of a line parallel to 
the imaginary axis. 

Apart from implicit model-following, another approach for incorporating command 
response criteria into the linear regulator design is explicit model-following. This method 
was found to be very useful in the synthesis of control laws that produced good pitch-rate 
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and normal load factor responses. The method consists of placing an ideal model of the 
airplane to be controlled in the forward path of the control loop. 

The mathematical development of the linear regulator design and the appropriate 
equations are presented in Volume II, Appendix E, Subsection E.6.2. 

11.6.2 MODIFIED KALMAN FILTER DESIGN 

After solving the control problem using the modified linear quadratic regulator design 
outlined previously, it is necessary to construct a state estimator. The usefulness of state 
estimators has been limited by the sensitivity of the closed-loop performance to 
parameter variations. The modeling of a process is never exact, and because the design of 
a system is based on an approximate model, the design must be insensitive to modeling 
uncertainties, in particular with respect to the stability of the system. Optimal control 
with full-state feedback offers a gain of -6 to + » dB and +60-deg phase margins in all 
control loops. When a Kalman filter is inserted into the loop to estimate state variables, 
the stability margins shrink, sometimes drastically. To alleviate this problem, a method 
has been used that allows the increase of stability margins in each control loop at the 
expense of filter performance when parameters are at their nominal values. A brief 
description is given in Volume II, Appendix E, Subsection E.6.3. 

1 1 .6.3 CONTROLLER SIMPLIFICATION 

The Kalman filter will have the same dynamic order as that of the open-loop model used 
for the synthesis. In the case of a flexible airplane model that contains a large number of 
structural modes, the high order of the filter imposes an excessive and unnecessary 
computational burden on flight computers. The most suitable approach to the design of a 
low-order suboptimal filter has not been determined during this study. However, a 
preliminary approach will be outlined here. The first task is to establish the minimum 
bandwidth of the controller. The actuation bandwidth is set by the highest frequency 
mode that must be controlled. In the case of flutter suppression, it is set by the highest 
frequency mode that contributes significantly to the gust loads. The latter is easily 
determined from cumulative power density plots of the appropriate performance 
parameters such as bending moments, torsional moments, accelerations, etc., at various 
airplane stations. A third factor that must be considered is the increasing uncertainty in 
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the dynamic model with increasing frequency. Above a certain frequency, the modeled 
dynamics in terms of frequencies and mode shapes are at best suspect. The controller 
bandwidth must be limited such that at these higher frequencies the closed-loop system 
has sufficiently large stability margins. 

The modal residualization technique can be used to eliminate filter modes that are outside 
the required actuation bandwidth. The reduced filter may still be too complex for 
practical implementation on flight computers. Further reduction may still be possible 
without any significant loss in closed-loop performance. Again, the modal residualization 
technique can be used to eliminate filter modes that are within the actuation bandwidth 
but that are associated with weakly observable or weakly controllable airplane modes or 
with airplane modes that are not observable from the cost function. 

In the preceding discussion, it was assumed that the Kalman filter was synthesized using a 
full-order airplane model and that the lower order suboptimal filter was obtained by the 
reduction of this full-order filter. However, another approach would be to reduce the 
open-loop model using the modal residualization technique, leaving only the modes 
considered essential to the control task. A suboptimal filter (with respect to the full- 
order model) would then be synthesized using the lower order airplane open-loop model. 

Still another approach would be to use the full-order Kalman filter to define the required 
control-loop frequency responses over the actuation bandwidth and to design lower 
response characteristics. This could involve least-square fitting, other optimization 
techniques, or simply trial-and-error design. 

11.7 CLOSED-LOOP ANALYSIS 

The closed-loop analysis consists of evaluating the performance of full- and partial-state 
feedback designs and full- and reduced-order Kalman filter designs in terms of gust 
response and stability margins. This analysis is an important part of an iterative design 
procedure that is divided into two parts: the control problem is solved by synthesizing and 
analyzing the closed-loop performance of full- or partial-state feedback designs. After 
the proper cost function and associate state feedback gain matrix have been determined, 
the Kalman filter is synthesized and inserted in the control loop, and the closed-loop 
performance is evaluated. The performance of various reduced-order filters is evaluated 
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until one is found that gives close to the optimum closed-loop performance with adequate 
stability margins and without imposing excessive computational burden on flight 
computers. The formulation of the models used for closed-loop analyses is given in 
Volume II, Appendix E, Subsection E.7.1. 

11.7.1 CLOSED-LOOP STABILITY 

The closed-loop stability analysis consists of computing eigenvalues, gain and phase 
margins in all control loops, and the range of values of key parameters such as dynamic 
pressure, for which the closed-loop system remains stable. The various closed-loop 
control laws are evaluated based on location of closed-loop poles and the margins of 
stability as a function of frequency. 

If the synthesis model has full order, then the full-state feedback system is optimal with 
respect to the cost function, stable if all unstable open-loop modes are controllable, and 
robust with respect to parameter variations in the control loops. Similarly, the closed- 
loop system with the full-order Kalman filter is always stable provided that all unstable 
open-loop modes are controllable and observable. With the Kalman filter inserted into the 
control loop to estimate the states, the good stability margins of the full-state feedback 
design may shrink, sometimes drastically. For the closed-loop system with reduced-order 
filter, there is no guarantee that the system is stable even at the nominal gain and phase. 

1 1 .7 .2 CLOSED-LOOP RESPONSE 

The steady-state gust response correlation matrices for the states, modal states, 
measurements and performance parameters (such as bending moments, torsional moments, 
accelerations, etc.), and the output power spectral density of selected performance 
parameters are computed. The transient responses due to discrete gusts and elevator 
commands are obtained by simulations. Because the load equations are based on a 
truncated set of modal coordinates, the absolute magnitudes of the loads are not correct. 
However, because all modes that are significant with respect to the control task are 
included, and the same truncated model has been used to compute the gust loads of the 
open-loop airplane, these approximate load calculations are sufficient for evaluating the 
relative merits of various control laws. The closed-loop gust response is evaluated in 
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terms of the relative reduction in the related performance parameters and the peak and 
rms deflections and rates of the control surfaces. 

1 1.7.3 EVALUATION OF STATE FEEDBACK DESIGNS 

The closed-loop analysis of the state feedback design is part of the iterative design cycle 
to solve the control task. Full-state feedback designs are evaluated until the proper cost 
function and control surfaces have been selected. The evaluations are based on gust-load 
reductions, control surface activities, and closed-loop eigenvalues. 

Because the control law includes feedback of control surface states, the optimal linear 
regulator can be used to determine whether or not the control surface actuators have 
sufficient bandwidth. If there is a significant change in the actuator closed-loop 
eigenvalues from their nominal open-loop values, it will be necessary to increase the 
actuation bandwidth. 

The trade between closed-loop performance and actuation bandwidth can be determined 
by considering the cumulative power-spectral-density plots of the open-loop and full-state 
closed-loop gust responses of the various performance parameters. The effects of 
eliminating modes from the feedback can be determined by evaluating the closed-loop 
performance with the appropriate columns in the optimal gain matrix set equal to zero. 

1 1.7.4 EVALUATION OF KALMAN FILTER DESIGNS 

The closed-loop analysis of the Kalman filter designs is part of the iterative design cycle 
to solve the state estimation problem. Full-order Kalman filters are evaluated until the 
closed-loop performance and stability margins meet or exceed the design requirements. 
The key design parameters evaluated are types, numbers, and locations of sensors and the 
trade between gust response and stability margins. This same iterative analysis is used to 
evaluate reduced-order filters. 
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12.0 CONTROL LAWS FOR FMC AND GLA 


Constant gain control laws for suppression of a symmetric flutter mode and reduction of 
loads due to vertical gusts have been synthesized at eight flight conditions for the Initial 
ACT Airplane. They correspond to four speed conditions identified as V^, and 

1.2Vj^ and two mass distributions as indicated in Table 36. The first four are used for 
gust-load alleviation (GLA) design, while the latter four are used for flutter-mode control 
(FMC) design. 


12.1 DYNAMIC MODEL DESCRIPTION 

At each flight condition, the flexible airplane is represented by a set of constant 
coefficient second-order differential equations modified by the addition of first-order lag 
terms that represent the effects of unsteady aerodynamics associated with gust inputs. 


Table 36. Flight Conditions for Dynamic Models of the Initial ACT Airplane 


Flight 

condition 

Speed 

condition 

Equivalent 
airspeed, m/s 
(kn) 

Mass 

condition 

Altitude, 
m (ft) 

Pressure, 
N/m^ (Ib/ft^) 

1 

Vb 

142 (276) 

0.8F 

10 668 (35 000) 

12 344 (258) 

2 

Vb 

142 (276) 

MZFW+F 

10 668 (35 000) 

12 344 (258) 

3 

''mo 

176 ( 341) 

0.8F 

7 833 (25 700) 

18 846 (394) 

4 

''mo 

176 (341) 

MZFW+F 

7 833 (25 700) 

18 846 (394) 

5 

''d 

214 (416) 

0.8F 

4 968 (16 300) 

28 049 (586) 

6 

''d 

214 (416) 

MZFW+F 

4 968 (16 300) 

28 049 (586) 

7 

1.2Vd 

262 (508) 

0.8F 

1 890 (6 200) 

41 887 (875) 

8 

1.2V(3 

262 (508) 

MZFW+F 

1 890 (6 200) 

41 887 (875) 


• Symmetric model 768-103 

• Mach number M = 0.86 

• Mass = 1 22 470 kg (270 000 lb) 

• 0.8F = 80% fuel (including full reserve tanks) plus payload to 
maximum gross weight resulting in aft center of gravity (0.46c) 

• MZFW+F = Maximum zero fuel weight plus fuel (including full reserve tanks) 
to maximum gross weight resulting in forward center of gravity (0.22c) 
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The development of these equations is described in Section 11.0 and in more detail in 
Volume II, Appendix E. The model has 2 rigid and 19 flexible body modes. The latter 
range in frequency from approximately 1 1 to 302 rad/s. The lag and scaling constants in 
the three Kussner lift-growth functions (fig. 120) were computed assuming an infinite 

c, = 0.236 

C2 = 0.513 (19) 

C3 = 0.171 

where V is the true airspeed (see table 36) and c is the characteristic chord length 
c = 6.03m (237.4 in). 

The dynamic models of the actuators for the elevator and the outboard aileron are shown 
in Figure 123. Originally, these were represented by second-order dynamics; however, an 
additional lag filter with a time constant of 0.001 sec was added. This was done to avoid 
the explicit dependence of acceleration measurements on actuator commands. Another 
approach would be to include sensor dynamics in the model. 

The output models for measurements and loads are described in Subsection 11.1.2. The 
elements of the mode shape matrix for pitch-rate measurement at the center of gravity 
and vertical acceleration measurement at the wing tip are listed in Volume II, Appendix F, 


aspect-ratio wing (ref 8) and expressed as 

dj = 0.058 
dj = 0.364 (^) 
d3 =2.42 {^) 


Elevator: 


'^0 

8x 10^ 

J 


(s + 20) (s + 40) (s+ 1000) 


Outboard 

aileron' 




8x 10^ 

5a 

J 


(s + 20) (s + 40) (s+ 1000) 

1 


Figure 123. Control Surface Actuator 
Dynamics 
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for the two airplane mass conditions. Table 37 lists the rigid- and flexible-body free- 
vibration modes. The measurements were transformed from inertial axes to body-fixed 
axes. Elements of the load distribution matrix are also referenced to body-fixed axes. 
The six load equations represent the bending moment, torsional moment, and shear at an 
inboard (tj = 0.25) and an outboard (tj = 0.75) wing station. Details are shown in Volume II, 
Appendix F. 

The wind disturbance model is based on the Dryden spectrum for a vertical gust with a 
turbulence scale length of 533.4m (1750 ft). 


Table 37. Description of Airplane Rigid and Flexible Modes 


Modes 

Symbol 

Units 

Description 

Sign convention 

^1 

u 

in/s 

Fore and aft velocity of center of gravity 

- 1 - forward 

■9 

w 

in/s 

Vertical velocity of center of gravity 

+ downward 


q 

rad/s 

Pitch rate 

+ nose up 

^4 



Forebody vertical bending deflection 


^5 



First aft-body vertical bending deflection 


^6 



Second aft-body vertical bending deflection 


^7 



First vertical tail vertical bending deflection 


% 



Second vertical tail vertical bending deflection 


qg 



First horizontal tail vertical bending deflection 


tllO 



Second horizontal tail vertical bending deflection 


‘111 



Horizontal tail torsion deflection 


qi2 



First wing vertical bending deflection 


^13 




’ Second wing vertical bending deflection 
for 0.46c condition 

First wing fore and aft bending deflection 
. for 0.22c condition 






First wing fore and aft bending deflection 
for 0.46c condition 

Second wing vertical bending deflection 
. for 0.22c condition 


^15 



First wing torsion deflection 


•^16 



Third wing vertical bending deflection 


^17 



Second wing fore and aft bending deflection 


'iis 



Second wing vertical bending deflection 


‘IlQ 



Second wing torsion deflection 


^20 



Nacelle side bending deflection 


q2i 



Nacelle vertical bending deflection 


q22 



Nacelle roll deflection 
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The elements of the state vector for the combined airplane actuation system and wind 
model are listed in Table 38. 


Table 38. Description of the System State Vector 


Modes 

Symbol 

Units 

Description 

Sign convention 


u 

in/s 

Fore and aft velocity of center of gravity 

+ forward 

X 2 

w 

in/s 

Vertical velocity of center of gravity 

+ downward 


q 

rad/s 

Pitch rate 

nose up 



rad 

Pitch angle 

+ nose up 




Forebody vertical bending rate 





Forebody vertical bending deflection 





First aft-body vertical bending rate 


Xs 



First aft-body vertical bending deflection 


Xg 



Second aft-body vertical bending rate 


Xio 



Second aft-body vertical bending deflection 


Xl 1 



First vertical tail vertical bending rate 


Xl 2 



First vertical tail vertical bending deflection 


Xl 3 



Second vertical tail vertical bending rate 


Xi 4 



Second vertical tail vertical bending deflection 


Xl 5 



First horizontal tail vertical bending rate 


Xl 6 



First horizontal tail vertical bending deflection 


Xl 7 



Second horizontal tail vertical bending rate 


Xl 8 



Second horizontal tail vertical bending deflection 


Xi 9 



Horizontal tail torsion rate 


X20 



Horizontal tail torsion deflection 


X2I 



First wing vertical bending rate 


CM 

CM 

X 



First wing vertical bending deflection 


X23 



Second wing vertical bending rate 


X24 



Second wing vertical bending deflection 


X25 



First wing fore and aft bending rate 


X26 



First wing fore and aft bending deflection 


CM 

X 



First wing torsion rate 


X28 



First wing torsion deflection 
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Table 38. Description of the System Vector (Continued) 


Modes 

Symbol 

Units 

Description 

Sign convention 

^29 



Third wing vertical bending rate 


^30 



Third wing vertical bending deflection 


^31 



Second wing fore and aft bending rate 


^32 



Second wing fore and aft bending deflection 


^33 



Second wing vertical bending rate 


^34 



Second wing vertical bending deflection 


^35 



Second wing torsion rate 


^36 



Second wing torsion deflection 


^37 



Nacelle side bending rate 


^38 



Nacelle side bending deflection 


^39 



Nacelle vertical bending rate 


X40 



Nacelle vertical bending deflection 


X 41 



Nacelle roll rate 


X 42 



Nacelle roll deflection 


X43 



First Kussner lift-growth state 


X 44 



Second Kussner lift-growth state 


^45 



Third Kussner lift-growth state 


X 46 


rad/s^ 

Elevator acceleration 


X 47 


rad/s^ 

Elevator rate 


CO 

X 


rad 

Elevator deflection 


X49 


rad/s^ 

Outboard aileron acceleration 


0 

in 

X 

«A 

rad/s 

Outboard aileron rate, 


^51 

«A 

rad 

Outboard aileron deflection 


^52 



First Dryden gust model state 


^53 



Second Dryden gust model state 
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12.2 SELECTION OF CONTROL SURFACES 


Seven control surfaces have been considered for the control task: inboard and outboard 
elevators, complete elevator, inboard and outboard segments of the outboard aileron, 
complete outboard aileron, and inboard aileron. The suitability of these control surfaces 
has been analyzed as outlined in Subsection 11.5.3. The relative controllability of the 
flutter mode at flight conditions 5, 6, 7, and 8 is shown in Volume II, Appendix F, 
Table F-3. Among the surfaces considered and with the specified control authorities, the 
outboard aileron is most suitable for FMC. However, the outboard portion of the outboard 
aileron is also suitable for this task, having relative controllability of about 0.70 at these 
flight conditions. 

Tables F-4 through F-7 (vol. II, app F) show the relative root-mean-square (rms) load 
responses to white noise inputs at the actuators for flight conditions 1, 2, 3, and 4, 
respectively. The relative rms load response is defined as the ratio between the actual 
rms load response and the maximum rms load response (from the set of all control 
surfaces). If the relative rms load response is 1.0, then the associated surface is the most 
effective surface for controlling that particular load (shear, bending, or torsion). Among 
the surfaces considered and with the specified control authorities, the outboard aileron 
and elevator are most suitable for controlling the wing loads. 

In addition, safety, actuator installation, and other design requirements must be 
considered. A small control surface with limited control authority that is dedicated to 
automatic control functions will have obvious advantages with regard to failures and 
actuator bandwidth and resolution. The location of the control surface may affect other 
design requirements that have not been considered in the analysis of the open-loop 
airplane. For example, using the elevator to control the loads at the wing root may 
adversely affect the ride and handling qualities of closed-loop airplanes. Thus, the final 
selection of control surfaces should only be done after the analysis of the closed-loop 
performance of various control surface configurations. The open-loop analysis described 
in Subsection 11.5.3 should primarily be used to identify all control surface configurations 
that are possible candidates. 

The control law synthesis performed in this study used the combination of the elevator 
and the outboard aileron for control. 
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12.3 SELECTION OF SENSORS 


Sensor selection criteria are described in detail in Subsection 11.5.4. The two criteria 
used are mode observability and performance parameter observability. The first is 
important in the selection of sensors for FMC, and the second is important in the 
selection of sensors for GLA. Three sensors have been selected: one pitch-rate gyro at 
the center of gravity will be used to observe the short-period mode and two vertical 
accelerometers located symmetrically (one in each wing) will be used to observe the 
structural modes of the wing. The subsequent analysis was only concerned with finding 
the best location for the wing-mounted accelerometers. 


The sensor locations considered in this study are shown in Figure 124. Each location is 
identified by a number between 1 and 27. The locations are distributed spanwise along the 
elastic axis and the rear spar of the wing. The relative observability of the two modes 
involved in the flutter of the wing was determined for flight conditions 5, 6, 7, and 8. The 
sensor-to-flutter mode coupling is explained in Subsection 11.4. Plots presented in 
Volume II (app F) show these values normalized to the coupling at sensor location 27. 
Sensor location 27, on the rear spar and at the wing tip, is most suitable for flutter 
suppression using vertical accelerometers. 



Sensor 


1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 

25 

26 
27 


Figure 124. Candidate Wing Accelerometer Locations 
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The output gust response correlation matrices for the open-loop airplane were computed 
as described in Subsections 11.3 and 11.5. These data illustrate the relative cross- 
variances between accelerometer outputs and bending moments, the results being 
normalized with respect to the rms level of the bending moments. Similar data were 
obtained for the closed-loop airplane. In this case, a full-state feedback control law is 
assumed. Detailed data are presented in Volume II, Appendix F. 

Sensor position 27 was selected for the subsequent Kalman filter designs for the following 
reasons: high flutter-mode observability, high rms output, and good correlation with the 
inboard wing bending moment, which was selected as the main gust-load parameter to be 
reduced by feedback control (see subsec 12.4). 



\2A GLA DESIGNS 


Several intermediate designs were synthesized before selecting a final design for gust- 
load reduction. Table 39 lists designs used, and Figure 125 contains a flow chart of the 
approach followed in the design for each flight condition. Figure 126 shows how the eight 
flight conditions were integrated into the final design. Results at each of the inter- 
mediate design steps will be discussed to show how the final design was reached. 


Full-state feedback design (design A) is the initial step in the design process for gust-load 
reduction. The design is determined by the values selected for the parameters in the cost 
function 

^OO 

J = i [(Q]y2-K32y2-K33y24Q^y2) + (R] 6 e^2+R2 ^20) 

where 

Ql = •^l/y'lmax 

Q 2 = ^^2/y^2max 

^3 = '^3''y^3max 

4max 


Table 39. Design Types 


Type 

Name 

A 

Full-state feedback 

B 

Nominal Kalman filter 

C 

Robust Kalman filter 

D 

Reduced-order Kalman filter 

E 

Reduced-order Kalman filter with gain reduction 
in one or both control loops 

F 

Integrated 8th-order filter for flight conditions 
1 , 2, 3, and 4 

G 

Integrated 1 0th-order filter for flight conditions 
5, 6, 7, and 8 

H 

Final 8th-order filter integrated for all flight 
conditions 
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Design C 


Design E 


Figure 125. Design Process for AH Flight Conditions 
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Figure 126. Integration of Designs From AH Flight Conditions 
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max 


R, = 1. 0/5^2 

1 t 

= 1. 0/5^2 

max 

and 

= wing bending moment at the inboard station (tj = 0.25) 

Y2 = wing torsion at the inboard station (t? = 0.25) 

= wing bending moment at the outboard station (tj = 0.75) 

y^ = wing torsion at the outboard station (i? = 0.75) 

5^ = command input to the elevator 

c 

= command input to the outboard aileron 
c 

In selecting appropriate values for the cost function parameters, their relative weighting 
is of prime consideration. However, to achieve a reasonable first guess, the following 
values were assumed as representative: 

6^ =3 deg 

max 

6^ = 15 deg 

max 

y. = corresponding open-loop load (i = 1,4) 

^ max 

K. = 1 (i = 1,4) 

In all the full-state designs, 5^^ and 5^ were not changed. Although the 

*^max ^max 

correlation between changes in particular loads and control surface activity varies, 
generally an increase in value of one or more of the K. results in a decrease of the 
corresponding load and an increase in the remaining loads and control surface activity. 
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Full-State design objectives included reducing bending moment loads and avoiding an 
increase in torsion loads while keeping the aileron rate within approximately 1.5-deg/s 
rms for a gust intensity of 0.305 m/s (1 ft/s). Gust response calculations used the Dryden 
spectrum with a turbulence scale length of 533.4m (1750 ft). 

Gust loads were reduced in design A for flight conditions 1, 2, 3, and 4 by incorporating a 
combination of four cost function parameters: inboard bending moment, inboard torsion, 
outboard bending moment, and outboard torsion. The combination and relative weighting 
varied with flight conditions, although the penalty on inboard bending moment predomi- 
nated. However, to illustrate the effects of changes in the cost function, flight condition 
3 was considered with different penalty weights on inboard bending moment and inboard 
torsion. Figures 127 and 128 show the changes in loads and control surface activity as the 
penalty on both loads is increased proportionately. 

Note that although the control surface activity increases as the penalty on loads 
increases, the changes in loads are less predictable. The design corresponding to a factor 
of /u = 4 was selected because it provided good reduction in the bending moments with 
reasonably low control surface activity. 

Table 40 shows the weighting factors of the cost functions selected for the final full-state 
designs of each flight condition. The resultant performance in load reduction and control 
surface activity for flight conditions 1, 2, 3, and 4 is given in Tables 41 through 44. 
Power-spectral-density (PSD) plots illustrating the load reduction and corresponding 
control activity provided by design A are given in Volume II, Appendix F. Note that, as 
expected, the short period is predominant in all loads and that inboard torsion is 
influenced by the flutter mode and first structural mode due to engine inertia response. 
The first structural mode also contributes to the outboard bending moment. Elevator 
activity is primarily in response to the short period and first structural mode, while 
aileron activity is dominated by the first structural and flutter modes. The open-loop and 
closed-loop poles tabulated in Volume II, Appendix F, for each of the four flight conditions 
show that damping ratios for phugoid, short-period, and first structural modes were 
significantly increased by design A. 

Design B resulted from combining a Kalman state estimator with the full-state feedback 
design. The process and sensor noise characteristics used in the estimator design are 
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Percent of open-loop load 
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Rms control surface rate, deg/s 



Cost function 

Symbol 


Parameter 

Weighting factor 

Qi 

Inboard bending moment 

(3.17 X lO’^'^) xju/(N m)2 
{(2.48 X 10''2)xM/(in-lb)^) 


Qj 

Inboard torsion 

(1.79 X 10'''^)xM/(Nm)2 
(1.40x10'''^)xju/(in-lb)2) 


Q 3 

Outboard bending moment 

0 


Q4 

Outboard torsion 

0 


R] 

Elevator deflection 

364.76/(rad/s)2 

• 

«2 

Aileron deflection 

14.59/(rad/s)^ 

A 


Elevator rate 



0 


Aileron rate 

- 

A 

1 — 
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Rms control surface deflection, deg 



Table 40. Cost Function Parameters in 

Full-State Designs ( 


Flight 

condition 

Inboard 

Outboard 

Bending 

moment 


Bending 

moment 

Torsion 


Qi 

wSM 

Q3 

Q4 

1 

0.904 

12.6 

23.8 

0 

2 

0.859 

0.675 

0 

177.0 

3 

0.990 

5.58 

0 

0 

4 

0.616 

0 

0 

49.5 

5 

0.390 

1.38 

0 

0 

6 

0.0167 

1.64 

0 

30.6 

7 

0.376 

1.20 

0 

24.5 

8 

0 

0 



0 

16.7 


-13 

All values above multiplied by 10 

R'] = 364.8 and R 2 = 14.59 for all flight conditions 



Table 41. Root-Mean-Square Gust Response, Flight Condition 1 


Design 

Filter 

order 

Load reduction, percent of open loop 

ftms control surface activity 


Inboard 

Outboard 

Elevator 

Outboard aileron 

Shear 

Bending 

moment 

Torsion 

Shear 

Bending 

moment 

Torsion 

Deflec- 

tion, 

deg 

Rate, 

deg/s 

Deflec- 

tion, 

deg 

Rate, 

deg/s 

A 

- 

84.2 

57.1 

97.2 

21.0 

29.3 

93.4 

1.20 

8.40 

5.14 

43.2 

b1^ 

53 

87.0 

67.5 

91.5 

40.5 

33.0 

92.3 

0.888 

7.20 

4.06 

45.0 

c[^ 

53 

87.1 

6ao 

92.5 

41.3 

33.6 

93.0 

0.798 

6.26 

4.02 

44.0 

dC^ 

8 

87.4 

68.2 

99.6 

40.9 

32.5 

93.2 

0.738 

7.48 

4.08 

43.4 

e[3> 

8 

89.0 

80.9 

92.8 

72.1 

68.5 

87.3 

0.688 

5.80 

1.60 

16.6 

F,hE> 

8 

85.6 

75.9 

89.7 

65.6 

62.6 

84.4 

0.950 

7.76 

1.79 

17.9 


Response to 8.53-m/s (28-ft/s) rms gust intensity 
DRO gain and phase margin requirements not satisfied 
gain reduced to 0.56, 6^ gain reduced to 0.26 
[ 51 ^ Design for flight condition 3 with 5^ loop gam reduced to 0 63 
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Table 42. Root-Mean-Square Gust Response, Flight Condition 2 


Design 

Filter 

order 

Load reduction, percent of open loop 

Rms control surface activity 


Inboard 

Outboard 

Elevator 

Outboard aileron 

Shear 

Bending 

moment 

Torsion 

Shear 

Bending 

moment 

Torsion 

Deflec- 

tion, 

deg 

Rate, 

deg/s 

Deflec- 

tion, 

deg 

Rate, 

deg/s 

A 

— 

74.0 

56.2 

94.3 

48.6 

40.7 

99.7 

1.38 

9.90 

3.60 

33.4 

b[^ 

53 

76.7 

63.5 

87.7 

57.9 

43.7 

93.3 

1.16 

8.36 

3.06 

36.6 

mSS 

8 

77.7 

63.7 

96.0 

58.2 

43.3 

93.7 

1.10 

8.54 

3.04 

38.1 

BS9 

8 

79.1 

71.8 

91.8 

69.7 

67.1 

83.5 

1.11 

8.66 

1.55 

17.8 

F, 

8 

76.6 

68.5 

87.4 

65.6 

61.9 

84.7 

1.27 

8.82 

1.79 

20.0 


Response to 8.53-m/s (28-ft/s) rms gust intensity 
DRO gain and phase margin requirements not satisfied 
gam reduced to 0.79; 5^ gam reduced to 0.37 
Design for flight condition 3 with 6^ loop gam reduced to 0 63 


Table 43. 


Root-Mean-Square Gust Response, Flight Condition 3 




Load reduction, percent of open loop 

Rms control surface activity 


Design 

Filter 

Inboard 

1 

Outboard 

Elevator 

Outboard aileron 

order 

Shear 

Bending 

moment 

1 

Torsion 

Shear 

Bending 

moment 

Torsion 

Deflec- 

tion, 

deg 

Rate, 

deg/s 

Deflec- 

tion, 

deg 

Rate, 

deg/s 

A 

- 

91.3 

66.7 

89.8 

34.4 

48.5 

103 

1.25 

10.4 

3.65 

33.8 

bE> 

53 

91.9 

75.3 

81.4 

50.9 

49.9 

96.3 

0.980 

9.23 

2.76 

34.8 


53 

92.6 

78.4 

83.5 

56.5 

52.3 

96.6 

0.758 

7.06 

2.48 

30.3 

dE>* 

8 

92.3 

78.9 

92.9 

55.0 

47.1 

96.9 

0.684 

6.78 

2.52 

29.7 


8 

90.7 

79.5 

91.4 

62.2 

56.5 

91.6 

0.799 

7.71 

1.91 

23.2 

F,hE> 

8 

90.6 

79.5 

91.3 

62.8 

57.4 

91.2 

0.788 

7.79 

1.86 

22.7 


|T^> Response to 6.40-m/s (21 -ft/s) rms gust intensity 
[?> DRO gain and phase margin requirements not satisfied 
6^ gain reduced to 0.71 

gain reduced to 0.69 for compatibility with flight condition 4 
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Table 44. Root-Mean-Square Gust Response, Flight Condition 4 




Load reduction, percent of open loop 

Rms control surface activity 

Design 

Filter 

Inboard 

Outboard 

1 

Elevator 

Outboard aileron 

order 

Shear 

Bending 

moment 

Torsion 

Shear 

Bending 

moment 

Torsion 

Deflec- 

tion, 

deg 

Rate, 

deg/s 

Deflec- 

tion, 

deg 

Rate, 

deg/s 

A 

— 

83.1 

6a 8 

95.4 

62.0 

53.9 

99.2 

1.03 

8.51 

2.34 

25.1 


53 

84.7 

73.9 

90.6 

68.7 

55.5 

93.4 

0.869 

7.29 

2.07 

26.9 


8 

86.4 

74.1 

95.3 

68.9 

55.4 

93.5 

0.854 

7.58 

2.18 

29.7 


8 

86.3 

74.8 

96.9 

70.8 

63.1 

89.8 

0.914 

8.13 

1.74 

23.7 

F,hE> 

8 

84.8 

73.7 

92.0 

69.3 

59.8 

90.8 

1.02 

9.05 

1.86 

18.0 


[T;> Response to 6.40-m/s (21-ft/s) rms gust intensity 

DRO gain and phase margin requirements not satisfied 
6^ gam reduced to 0.75 

Design for flight condition 3 with 5^ loop gam reduced to 0.69 

given in Table 45. The Kalman filter introduced more reduction in performance than any 
other step in the design process. For flight conditions 1, 2, 3, and 4, inboard bending 
moment increases averaged 8%; outboard bending moment increases averaged over 2%. 
Torsion loads decreased nearly 4%. Elevator rates decreased slightly with moderate 
increase in the aileron rates when compared with design A. Results of these comparisons 
are summarized in Tables 41 through 44 for flight conditions 1, 2, 3, and 4. Closed-loop 
controller poles are tabulated in Volume II, Appendix F. 

Design B introduced deficiencies in phase and gain margin performance predominately in 
the aileron loop, at all four flight conditions. Margin requirements, which vary with flight 
condition, are summarized in Table 46. These phase and gain requirements are displayed 
graphically on a Bode plot by a band around -180 deg and 0 dB, respectively. For example, 
a phase margin of 60 deg is defined by lines at -120 deg and -240 deg. The phase margin is 
defined at points of 0-dB gain to be the difference between the actual phase and -180 deg. 
Consequently, if the phase curve is within the region bounded by -120 deg and -240 deg at 
a point of 0-dB gain, the phase margin of 60 deg is not met. An analogous definition 
applies to gain margin. 
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Table 45. Plant Process Noise and Sensor Noise Characteristics 
Used in Kalman Estimator Designs 


Wind disturbance 
intensity 

Pitch-rate sensor noise 
intensity 

Wing-tip accelerometer 
sensor intensity 

4.267 m/s (14.0 ft/s) 

0.15 deg/s 

0.05g 


Note; Gaussian power density function, 
one standard deviation 


Table 46. Stability Margin Requirement 


Frequency 
range, rad/s 

Flight condition 

1.2 

3,4 

5,6 

7,8 

Low 

frequency 

0<oj<0.5 

0<6u <0.5 

0<a><0.5 

0< w<0.5 

±4dB 

+15 deg 

±4dB 

±15 deg 

OdB 

0 deg 

OdB 

0 deg 

Medium 

frequency 

0.5<oj<11 

0.5 <o)< 13.4 

0.5< w< 14.3 

0.5< w< 13.4 

±6dB 

±45 deg 

±6 dB 

±45 deg 

±4 dB 

±20 deg 

OdB 

0 deg 

High 

frequency 

11.0< w 

13.4 <o) 

14.3 <cu< 39.5 

13.4 <u)< 40.6 

±12dB 

±180 deg 

±12 dB 

±180 deg 

±12dB 

±60 deg 

±6 dB 

±45 deg 


39.5 

40.6 < cu 

±12dB 

±180 deg 

±6dB 

±180 deg 


Points at which gain or phase margin is checked are indicated by vertical bars on the Bode 
plot. A vertical bar intersects the phase region at points of 0-dB gain and the gain region 
at points of -180-deg phase. If the vertical bar fails to intersect the gain or phase curve 
at one of these critical frequencies, the stability margin is satisfied. 

Stability margin deficiencies for design B in flight conditions 1 and 3 were considered 
serious enough to warrant a robust Kalman filter (design C). Values of input noise 
covariance used for these robust designs are shown in Table 47. Stability margins 
improved with a slight degradation in performance. All low- or mid-frequency margin 
deficiencies are eliminated by the robust design procedure. 
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Table 47. Input Noise Covariance in Robust 
Kaiman Filter Designs (Design C) 


Flight condition 

2 

Elevator, rad 

2 

Aileron, rad 

1 

0 

7.84 

2 

0 

0 

3 

3.25 

25.8 

4 

0 

0 

5 

0.197 

6.80 

6 

0 

40.3 

7 

0 

0 

8 

0 

0 


Modal residualization was used to reduce the 53rd-order Kalman filters of flight 
conditions 1, 2, 3, and 4 to 8th-order filters (design D). Modes selected for retention in 
the reduced filter were those with frequencies below 10 rad/s (which is within the control 
design bandwidth). Attempts to use this technique for further reduction resulted in 
unstable closed-loop designs for some flight conditions. By eliminating the dynamic 
contribution at the higher frequency modes, gain rolloff was experienced in the high- 
frequency mode for the aileron loop, which resulted in a significant improvement in the 
stability margins for flight conditions 1, 2, and 3. The inboard torsion load (which has 
been significantly reduced In design A at the flutter-mode frequency) increased an 
average of over 7% due to this gain rolloff. Little change resulted in other performance 
parameters (see tables 41 through 44). 

Design D did not satisfy stability margins in either loop for flight conditions 1 and 2 nor in 
the aileron loop for flight conditions 3 and 4. Table 48 gives the values used to reduce the 
appropriate loop gains to satisfy the margin requirements. Although the gain reductions 
for flight conditions 1 and 2 resulted in bending moment increases of 12% and 8%, 
respectively, the reduction prior to these changes in loop gains was much greater for 
flight conditions 1 and 2 than 3 and 4. 

Results were similar for outboard bending moment loads, although the changes were more 
dramatic. Tables 41 through 44 give the performance data for design E. Bode plots 
showing the stability margins for the preceding controller designs are included in Volume 
II, Appendix F (figs. F-47 through F-81). 
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Table 48. Loop-Gain Reduction Factors in Design Cases E, F, 
and H at AH Gust- Load Conditions 



Design E 

Designs F and H 

Flight condition 

Elevator loop 

Aileron loop 

Elevator loop 

Aileron loop 

1 

0.56 

0.26 

1.0 

0.63 

1 

2 

0.79 

0.37 

1.0 

0.63 

3 

1.0 

0.71 

1.0 

0.69 

4 

1.0 

0.75 

1.0 

0.69 


The final design step for GLA was to integrate the four E designs representing flight 
conditions 1, 2, 3, and 4. Although this could have been accomplished using the curve- 
fitting technique described in Subsection 11.4.3, it was found that design E from flight 
condition 3 actually reduced both inboard and outboard bending moment loads at other 
gust-load conditions more than the level provided by the design E developed individually 
for each of those flight conditions. 

In addition, control surface activity and torsion loads were generally lower. Slight gain 
reductions in the aileron loop were required to meet margin requirements (table 48). The 
lower of the loop gains required for flight conditions 1 and 2 (and separately for flight 
conditions 3 and 4) was used so parameter scheduling in the final design would only be a 
function of speed and independent of mass distribution. Tables 41 through 44 show the 
performance changes resulting from the integrated design F. Note the final integrated 
design H is the same as design F for flight conditions 1, 2, 3, and 4, but it also integrated 
flight conditions 5, 6, 7, and 8. 

The unexpected load reduction phenomena can be partially explained by the significant 
performance degradation experienced between designs D and E (tables 41 and 42) resulting 
from the loop gain reductions shown in Table 48. The improved performance of design F 
over design E is greatest in flight conditions 1 and 2 because of the major changes in loop 
gain at these conditions. 

PSD plots of design H for the bending moment and torsion at flight conditions 1, 2, 3, and 
4 are shown in Volume II, Appendix F (figs. F-14 through F-29). Although the rms inboard 
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torsion loads are significantly reduced from design A to design H, the reduction near the 
flutter mode (approximately 20 rad/s) is less for design H because control filter modes 
above 10 rad/s were eliminated in the reduction to an 8th-order filter. This is also 
reflected in the PSD plots (also in vol. II, app F), which show the aileron activity. 
Satisfactory stability margins were also achieved. 
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12.5 FMC DESIGNS 


Development of the FMC designs paralleled that of the GLA designs discussed in 
Subsection 12.4. For the full-state design, the cost function used was similar to that 
given in equation (20). FMC is achieved by satisfying the structural damping requirements 
of f = 0.015 for flight conditions 5 and 6 and ?= 0 for flight conditions 7 and 8. These 
requirements reflect an allowance for structural damping of ? = 0 at flight conditions 5 
and 6 and f = 0.015 at flight conditions 7 and 8. Other full-state design objectives 
included moderate rms aileron rate limits of 50 deg/s (flight conditions 5 and 6) and 75 
deg/s (flight conditions 7 and 8) for a gust intensity of 4.27-m/s (14-ft/s) rms. 


As reflected in the cost function parameters shown in Table 40, torsion was more of a 
problem than it was in the gust-load designs. Tables 49 through 52 list control surface 
activity and the damping ratio of the flutter mode. 


The flutter mode, caused primarily by coupling between wing vertical bending, wing 
torsion, and nacelle strut vertical bending, occurs at approximately 20.1 rad/s. 


For flight conditions 5, 6, and 7, design A significantly increases the short-period 
frequency while it decreases the phugoid frequency. In addition to stabilizing the flutter 
mode in all four flight conditions, damping ratio also increases significantly for a 


Table 49. Root-Mean-Square Gust Response, Flight Condition 5 


Design 

Filter 

order 


Rms control surface activity 

E> 

Flutter-mode characteristics 

Elevator 

Outboard aileron 

Deflection, 

deg 

Rate, 

deg/s 

Deflection, 

deg 

Rate, 

deg/s 

Damping 

ratio 

Frequency, 

rad/s 

Open loop 






-0.002 

19.8 

A 



0.665 

5.21 

2.08 

31.6 

0.080 

19.2 

B 


53 

0.536 

4.77 

1.89 

28.1 

0.080 

19.2 

C 


53 

0.513 

4.50 

1.81 

26.6 

0.080 

19.2 

D 


10 

0.524 

5.25 

1.51 

20.1 

0.023 

19.9 

G 


10 

0.309 

3.18 

1.36 

24.7 

0.020 

20.6 

H 


8 

0.013 

0.165 

1.36 

24.5 

0.019 

20.5 




Response to 4.27-m/s (14-ft/s) rms gust intensity 
DRO gain and phase margin requirements not satisfied 
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Table 50. Root-Mean-Square Gust Response, Flight Condition 6 


Design 

— 

Filter 

order 

Rms control surface activity 

Flutter-mode 

characteristics 

Elevator 

Outboard aileron 

Deflection, 

deg 

Rate, 

deg/s 

Deflection, 

deg 

Rate, 

deg/s 

Damping 

ratio 

Frequency, 

rad/s 

Open loop 






-0.005 

19.8 

A 



0.615 

4.44 

1.77 

40.7 

0.074 

19.8 

B 


53 

0.537 

4.26 


27.9 

0.074 

19.8 

C 


53 

0.506 

3.98 

mm 

25.9 

0.074 

19.8 

D, 

3 

10 

0.477 

3.69 

1.46 

27 3 

0 072 

20.0 

H 


8 

0.057 

0.209 

1.49 

— 

27.2 

0.027 

20.3 


[£> 


Response to 4.27-m/s (14-ft/s) rms gust intensity 
DRO gam and phase margin requirements not satisfied 


Table 51. Root-Mean-Square Gust Response, Flight Condition 7 


Design 

Filter 

order 

Rms control surface activity * 

Flutter-mode characteristics 

Elevator 

Outboard aileron 

Deflection, 

deg 

Rate, 

deg/s 

Deflection, 

deg 

Rate, 

deg/s 

Damping 

ratio 

Frequency, 

rad/s 

Open loop 






-0.014 

20.5 

A 


0.192 

1.85 

2.64 

76.3 

0 055 

21.3 

B 

53 

0.168 

2.21 

2.46 

58.9 

0.055 

21.3 

D 

10 

0.162 

2.13 

2 45 

54.6 

0.016 

20.5 

G 

10 

0 326 

4 27 

1.93 

50.6 

0.014 

20.2 

H 

8 

0.017 

0416 

1.87 

45.5 



0.011 

20 2 


* Response to 4.27-m/s (14-ft/s) rms gust intensity 
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Table 52. Root-Mean-Square Gust Response, Flight Condition 8 





Rms control surface activity 




Design 

Filter 

Elevator 

Outboard aileron 





Deflection, 

deg 

Rate, 

deg/s 

Deflection, 

deg 

Rate 

deg/s 

Damping 

ratio 

Frequency, 

rad/s 

Open loop 






-0.011 

20.3 

A 



3.34 

2.07 

74.2 

0.022 

20.2 

53 

0.094 

3.30 

2.15 

69.2 

0.022 

20.2 

D 

10 

0.081 

2.57 

2.00 

58.7 

0.025 

20.1 

G 

10 

0.530 

5.40 

2.14 

57.3 

0.040 

20.0 

H 

8 

0.057 

'0.437 

2.11 

52.7 

0.032 

19.9 


Fhght condition 8 

Response to 4.27-m/s (14-ft/s) rms gust intensity 
DRO phase and gain margin requirements not satisfied 


Structural mode of 25.7 and 27.8 rad/s of flight conditions 7 and 8, respectively. This 
mode appears to consist primarily of the first two wing bending modes and the aft-body 
bending mode. Open-loop poles for these conditions are tabulated in Volume II, 
Appendix F (figs. F-17 through F-20). 


The nominal Kalman filter (design B) resulted in a significant reduction in aileron rate for 
flight conditions 6 and 7 and a slight decrease in damping ratio for flight conditions 
5 and 7. Due to weaker requirements (table 46), stability margins were less constraining 
than in flight conditions 1, 2, 3, and 4. However, it might be expected that stability 
margins would be inadequate near the flutter mode because of the high gains required to 
stabilize the airplane. Although this was the case for flight conditions 5 and 6, design B 
provided satisfactory phase and gain margins for flight conditions 7 and 8. Bode plots and 
closed-loop controller pole tabulations are shown in Volume II, Appendix F, for these 
conditions. 


Because design B provided satisfactory stability margins for flight conditions 7 and 8, the 
robust Kalman filter was used only for flight conditions 5 and 6. Design C provided some 
improvement in phase and gain margins with a slight reduction in surface activity. 

The procedure to reduce the order of the Kalman filter was identical to that used in the 
gust-load designs. However, in addition to the lowest frequency modes that provided an 
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eighth-order filter, it was also necessary to retain a complex filter mode at the flutter 
frequency. The resulting lOth-order filter (design D) satisfied the stability margin 
requirements at flight conditions 5, 6, 7, and 8. The improved phase margins in the 
aileron loop were due to a combination of two tendencies at the flutter frequency caused 
by the filter reduction: sharper peaks in the gain curve and less lag in the phase. 
Design D also resulted in some reduction in the aileron rate and damping ratio for flight 
conditions 5, 7, and 8, while the opposite effect was observed for flight condition 6. The 
damping ratio was significantly reduced in flight conditions 5 and 7 but showed little 
change in flight conditions 6 and 8. 

Because all stability margins were satisfied, it was not necessary to reduce the loop gains 
as was done in flight conditions 1, 2, 3, and 4. The four flutter designs were integrated by 
selecting the critical design. Only design D at flight condition 6 provided satisfactory 
flutter damping at flight conditions for which it was not designed; thus it was used as the 
integrated flutter design G for flight conditions 5, 6, 7, and 8. 

The final step in the design procedure was to integrate the 8th-order design F (which 
provided satisfactory performance for flight conditions 1, 2, 3, and 4) with the lOth-order 
design G for flight conditions 5, 6, 7, and 8. These designs were integrated by curve- 
fitting an eighth-order filter with selected poles and zeros fixed from the gust-load design 
in each of the four control loops. Three pairs of poles were taken from the gust-load 
design; the fourth pair (at a frequency of 19.4 rad/s) was included to control flutter. 
Approximately one-half of the zeros were free to minimize the error between the original 
curve and the fitted curve. Figures 129 through 132 show the frequency response in each 
sensor to control surface loop of the lOth-order filter (design G) and the 8th-order fitted 
filter. The resulting curve fit is good, especially in aileron loop near the flutter 
frequency. 

The integrated eighth-order filter resulting from the curve-fitting technique was 
expressed as a matrix transfer function. Realization in the time domain was necessary to 
compute rms performance. This resulted in a 16th-order filter, which was reduced to 
8th order by retaining only the static portion of the pitch rate to elevator loop and the 
wing-tip accelerometer to aileron loop. Elimination of nonessential control loops 
decreased elevator activity and slightly decreased damping ratio of the flutter mode. 
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Phase, deg Gain,dB Phase, deg Gain.dB 


lOtIvorder integrated filter 

Bth-order integrated filter 



0.010 0.100 1.000 10.000 100.000 


Frequency, rad/s 

Figure 129. Integrated Flutter-Mode Control Design, 
Pitch Rate to Outboard Aileron Loop 


lOth-order integrated filter 

Bth-order integrated filter 



0.010 0.100 1.000 10.000 100.000 


Frequency, rad/s 

Figure 130. Integrated Flutter-Mode Control Design, 
Pitch Rate to Elevator Loop 
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Phase, deg Gain,dB Phase, deg 


-70 
-80 
-90 
-100 
-110 
-120 
-130 

0.010 0.100 1.000 10.000 100.000 



0.010 0.100 1.000 10.000 100.000 
Frequency, rad/s 

Figure 131. Integrated Flutter-Mode Control Design, 
Wing-Tip Acceleration to Elevator Loop 
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Figure 132. Integrated Flutter-Mode Control Design, 

Wing-Tip Acceleration to Outboard Aileron Loop 
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The final integrated design satisfied stability margin requirements at all four flutter 
flight conditions. Tables 49 through 52 show a slight improvement in control surface 
activity from design G, as well as a further decline in damping ratios. However, all 
remained well above minimum acceptable levels and wing loads were essentially 
unchanged. Activity for both elevator and aileron predominates at a frequency of 20 
rad/s for all flight conditions. In addition, the aileron has significant activity above 20 
rad/s for flight conditions 7 and 8. 

Figure 133 is a block diagram of the final integrated filter and gives the parameter gain 
schedule as a function of speed. Note that only four parameters change between Vg and 
^MO speeds. 



Actuator 
model 


model ^ 
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Figure 133. Block Diagram of Final Integrated Active Control Law Design 
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12.6 RESPONSE DUE TO DISCRETE GUSTS 


Time history simulation was performed to evaluate the effects of actuator nonlinearities 
on gust-load reduction. Ordinarily, substantially more computation is required for 
nonlinear simulation. However, due to a unique formulation of the nonlinear actuator 
model, it was possible to use the efficient linear simulation algorithm of Subsection 11.3.2 
for the nonlinear as well as the linear simulation. 


12.6.1 LINEAR SIMULATION MODELS 

The models used for linear simulation are derived from the continuous time models used 
for gust covariance analysis. The closed-loop linear equations consisting of the airplane, 
actuator, and eighth-order control law are 


x(t) 


A + BFj^C 


x(t) 


F + BFrE 

* 




+ 

Z(t) 


SrC Ar 


2(t) 


SrE 


where x(t) is the airplane state vector and z (t) is the filter state vector. 


The random gust w is replaced by a discrete (1-cos) gust, which is given by 

O 


w, 


,(t) =^(l-cos^) 


( 21 ) 


where is the discrete gust intensity, t is time, V is true airspeed, and c is the 
characteristic chord length. Table 53 defines the discrete gust parameters at each flight 
condition. 

The output equation is given by 


[c i 01 


x(tV 

z(t). 


+ Dwg(t) 


( 22 ) 
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Table 53. Discrete Gust Characteristics 


Flight 

condition 

Gust intensity, 
true airspeed 

Duration 

1, 2 

28.4 m/s 
(93.4 ft/s) 

0.591 sec 

3,4 

20.9 m/s 
(68.4 ft/s) 

0.568 sec 

5, 6 

9.8 m/s 
(32.2 ft/s) 

0.547 sec 


As described in Subsection 11.3.2, the system is block diagonalized and subsequently 
converted to a set of difference equations of the form 

z(t+At) = 0z(t) + 0Wg(t) (23) 

y(t) = Cz(t) + Dwg(t) (24) 

where z(t) is a set of modal coordinates. Note the gust input is assumed to be constant in 
the time interval between t and t + At. This model is then used by the algorithm of 
Subsection 11.3.2 to compute time histories of selected performance criteria. 

12.6.2 NONLINEAR SIMULATION MODELS 

The airplane, control law, and discrete gust models used for nonlinear simulation are 
identical to those of Subsection 12.6.1. However, the actuator model for each control 
surface was removed from the system matrix and modified to include the nonlinearities of 
position limit, rate limit, and hysteresis. 

The nonlinear actuator was represented by two linear models. The linear actuator of 
Figure 123 and given in block diagram form by Figure 134 is used when the actuator rate 
is below the specified rate limit. Whenever the rate exceeds the rate limit, the actuator 
model is changed from that shown in Figure 134 to the model shown in Figure 135. The 
latter is a linear model that approximates the characteristics of a rate-limited actuator. 
The effects of the rate limit are obtained by feeding back the actuator rate with a very 
high gain (1000 times that of the nominal model). 
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Figure 134. Actuator in Linear Range 



Figure 135. Actuator in Rate-Limited Range 


To ensure a smooth transition from one model to another, a bias input is used as shown in 
Figure 135. This bias is simply the value of the rate limit multiplied by the gain in the 
additional rate feedback loop. When a transition is made from the rate-limited actuator 
(fig. 135) to the linear actuator (fig. 13^), the bias is removed. 

A position limit and hysteresis were included at the command path to the actuator. The 
position limit is incorporated by simply limiting the command from the controller to the 
actuator. Figure 136 is a block diagram of the algorithm that implemented the model of 
the nonlinear actuator. The hysteresis effects in deflection (+0.25 deg) were modeled 
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Check on position 
limit, PLIM 


Hysteresis 


Check on rate 
limit, RLIM 



Figure 136. Nonlinear Actuator Model 


by a typical hysteresis algorithm. Table lists the nonlinear parameters used for each 
actuator during the nonlinear simulation. 

The two nonlinear actuators were then combined with the airplane and control law as 
shown in Figure 137. The complete nonlinear simulation functions as three separate 
coupled linear simulations with a delay between the airplane-controller simulation and the 
actuator simulations. A small time step ensures that the error introduced by this 
temporal decoupling is insignificant. 
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Table 54. Nonlinear Actuator Parameters 



Elevator 

Outboard 

aileron 

Position limit 

+ 10.0 deg 

±7.5 deg 

Rate limit 

40.0 deg/s 

55.0 deg/s 

Hysteresis 

±0.25 deg 

±0.25 deg 



Wind (t-At) 


Wind (t) 




t-At 


Time 


T 


Figure 137. Nonlinear Simulation Diagram 


t+At 
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12.6.3 SIMULATION RESULTS 


Time history simulations were performed to evaluate the wing loads and control surface 
activity in response to a discrete (1-cos) wind gust at flight conditions 1, 2, 3, 4, 5 , and 6. 
(Table 36 defines the various flight conditions.) Wing loads include shear, bending 
moment, and torsion at inboard (17 = 0.25) and outboard (tj = 0.75) stations. All loads 
evaluated are incremental from the nominal steady-state loads in Ig flight. Control 
surface activity includes the elevator and outboard aileron rate and deflection. 

At flight conditions 1, 2, 3, and 4, the airplane is stable and the primary consideration in 
the design process was load reduction. Incremental wing loads and control surface 
activity are shown for these flight conditions. At flight conditions 5 and 6, the 
unaugmented airplane is unstable and only control surface activity is shown. 

Time histories of the wing-load response parameters and control surface activity are 
shown in Volume II, Appendix F, for all conditions investigated. Each chart superimposes 
open-loop airplane response, response of the closed-loop system with a linear actuator, 
and closed-loop response with a nonlinear actuator. 

The actuator nonlinearity had little effect on inboard loads; however, outboard bending 
moment reduction was significantly affected. Load reduction benefits were reduced from 
approximately 32% for the linear actuator to approximately 25% with the nonlinearities 
for flight conditions 1 and 2 and from approximately 40% to 30% for flight conditions 3 
and 4. Effects on outboard shear were less pronounced. The torsion load increases that 
accompany bending and shear load reduction were, as would be expected, slightly reduced 
by the actuator nonlinearity. 

For flight conditions 1, 2, 3, and 4, elevator peak command did not exceed the limit of 10 
deg. The elevator peak rate command varied from 49 to 59 deg/s compared to the limit 
of 40 deg/s. The outboard aileron peak command was approximately 3 deg above the limit 
of 7.5 deg, while the corresponding command peak rate was nearly double the limit of 55 
deg/s. 

In flight conditions 5 and 6, the nonlinear actuator limits imposed a very slight constraint 
on system performance. Only the outboard aileron peak rate command exceeded the 
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specified limit. With such low elevator activity, hysteresis was a more significant 
nonlinearity than the aileron rate limit. Performance data for the six flight conditions 
are summarized in Tables 53 through 60. 

To better study the effects of actuator nonlinearities on system performance, nonlinear 
simulations were performed for a range of gust intensities. Even with gust intensities at 
three times the nominal level, some load relief was experienced. Inboard at approx- 
imately 35% to 45% of the bending moment, reduction experienced at the nominal gust 
intensity was lost. Outboard, where the load reduction was much greater at the nominal 
level, approximately 65% of the benefit was lost. The decreased benefit of higher gust 
levels caused torsion loads to decrease toward open-loop levels. 

Although load reduction was not the primary objective of the flutter suppression designs 
for flight conditions 5 and 6, the system robustness was checked at these flight conditions 
to determine the effect of actuator nonlinearities on stability. At greater than three 
times the nominal gust intensity, no adverse stability effects were observed. 


Tab/e 55. Discrete Gust Response for Flight Condition 1 


(a) incremental Load Reduction at Peak (Percent of Open Loop) 


Actuator 

Inboard, 17 = 0.25 

Outboard, t? = 0.75 

Shear 

Bending 

moment 

Torsion 

Shear 

Bending 

moment 

Torsion 

Linear 

105.0 

91.1 

106.0 

73.1 

68.7 

108.0 

Nonlinear 

105.0 

92.1 

105.0 

78.4 

75.4 

107.0 


(b) Peak Control Surface Activity 


Actuator 

Elevator 

Outboard aileron 

Deflection, deg 

Rate, deg/s 

Deflection, deg 

Rate, deg/s 

Linear 

6.52 

55.6 

10.3 

104.0 

Nonlinear 

6.53 

40.0* 

7.5* 

55.0* 


• Gust shape = (1 - cos) 

• Gust intensity = 28.5 m/s (93 4 ft/s) 

‘Limit value 
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Table 56. Discrete Gust Response for Flight Condition 2 


(a) Incremental Load Reduction at Peak (Percent of Open Loop) 


Actuator 

Inboard, r\ = 0.25 

Outboard, 17 = 0.75 

Shear 

Bending 

moment 

Torsion 

Shear 

Bending 

moment 

T orsion 

Linear 

102.0 

90.2 

107.0 

84.5 

67.0 

111.0 

Nonlinear 

102.0 

91.5 

105.0 

87.1 

74.7 

109.0 


(b) Peak Control Surface Activity 


Actuator 

Elevator 

Outboard aileron 

Deflection, deg 

Rate, deg/s 

Deflection, deg 

Rate, deg/s 

Linear 

8.29 

58.7 

10.6 

106.0 

Nonlinear 

8.06 

40.0* 

7.5* 

55.0* 


• Gust shape = (1 - cos) 

• Gust intensity = 28.5 m/s (93.4 ft/s) 

*Limit value 


Table 57. Discrete Gust Response for Flight Condition 3 


(a) Incremental Load Reduction at Peak (Percent of Open Loop) 


Actuator 

Inboard, 77 = 0.25 

Outboard, 17 = 0.75 

Shear 

Bending 

moment 

Torsion 

Shear 

Bending 

moment 

Torsion 

Linear 

109.0 

95.7 

110.0 

67.2 

60.9 

115.0 

Nonlinear 

108.0 

96.0 

108.0 

73.6 

69.5 

113.0 


(b) Peak Control Surface Activity 


Actuator 

Elevator 

Outboard aileron 

Deflection, deg 

Rate, deg/s 

Deflection, deg 

Rate, deg/s 

Linear 

5.07 

49.3 

10.1 

104.0 

Nonlinear 

5.38 

40.0* 

7.5* 

55.0* 


• Gust shape = (1 - cos) 

• Gust intensity = 20.9 m/s (68.4 ft/s) 

’Limit value 
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Table 58. Discrete Gust Response for Flight Condition 4 


(a) Incremental Load Reduction at Peak (Percent of Open Loop) 


Actuator 

Inboard, 17 = 0.25 

Outboard, 17 = 0.75 

Shear 

Bending 

moment 

Torsion 

Shear 

Bending 

moment 

Torsion 

Linear 

106.0 

95.0 

112.0 

86.9 

60.1 

118.0 

Nonlinear 

105.0 

95.5 

110.0 

89.2 

69.6 

115.0 


(b) Peak Control Surface Activity 


Actuator 

Elevator 

Outboard aileron 

Deflection, deg 

Rate, deg/s 

Deflection, deg 

Rate, deg/s 

Linear 

6.73 

52.7 

10.4 

107.0 

Nonlinear 

6.88 

— 1 

40.0* 

7.5* 

55.0* 


• Gust shape = (1 - cos) 

• Gust intensity = 20.9 m/s (68.4 ft/s) 

*Limit value 


Table 59. Discrete Gust Response for Flight Condition 5 


Peak Control Surface Activity 


Actuator 

Elevator 

Outboard aileron 

Deflection, deg 

Rate, deg/s 

Deflection, deg 

Rate, deg/s 

Linear 

1.21 

12.3 

5.12 

58.6 

Nonlinear 

1.06 

11.1 

5.04 

55.0* 


• Gust shape = (1 - cos) 

• Gust intensity = 9.8 m/s (32.2 ft/s) 

*Limit value 
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Table 60. Discrete Gust Response for Flight Condition 6 


Peak Control Surface Activity 


Actuator 

Elevator 

Outboard aileron 

Deflection, deg 

Rate, deg/s 

Deflection, deg 

Rate, deg/s 

Linear 

1.71 

14.3 

4.73 

60.2 

Nonlinear 

1.56 

13.2 

4.64 

55.0* 


• Gust shape = ( 1 - cos) 

• Gust intensity = 9.8 m/s (32.2 ft/s) 

*Limit value 
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12.7 COMPARISON WITH CURRENT TECHNOLOGY CONTROL LAWS 


Classical techniques were also used to synthesize control laws for flight conditions 
1 through 8. Performance data will be shown to compare the classical and optimal designs 
for flight conditions 2, 4, and 6. The results used for comparison are based on rms 
response to a von Karman gust and simulation with a discrete (1-cos) gust. 

Several distinctions should be noted regarding the two designs: 

• The optimal controller is designed as an integrated multiloop filter that addresses 
the functions of GLA, FMC, and pitch-augmented stability (PAS). The classical 
approach relies on single-loop design techniques, which results in a separately 
designed filter for each function. In addition to GLA, FMC, and PAS, the classical 
design also incorporated maneuver-load control (MLC). 

• The optimal design used the outboard aileron as one surface, together with the 
elevator, for all control tasks. In the classical design, the outboard aileron was split 
into an inboard section and an outboard section. FMC was accomplished by the 
inboard section, while the outboard section was dedicated to load reduction. The 
elevator was used primarily for PAS. 

• Both designs use two sensors: a pitch-rate gyro at the airplane center of gravity and 
a wing accelerometer. The classical design used sensor 11, which is somewhat 
inboard from the wing-tip accelerometer (sensor 27) of the optimal design (fig. 124). 

• The classical design was evaluated using the von Karman turbulence model. The 
optimal controller was designed to provide optimum performance to Dryden turbu- 
lence and was evaluated using both Dryden and von Karman models. 

The classical design is shown in Figure 138. For comparison, the optimal design is shown 
in Figure 133. 

The performance of both designs is summarized for flight conditions 2, 4, and 6. 
Tables 61, 62, and 63 show the response to a random gust. The classical control law 
performance is shown in response to a von Karman wind model. The response of 


367 



optimal design to both Dryden and von Karman turbulence is shown. Had the optimal 
controller been designed for the von Karman spectrum, its performance would likely be 
better. 

In achieving similar load reduction for flight conditions 2 and 4, the classical design 
required significantly greater aileron activity (particularly in aileron rate) and somewhat 
less elevator activity than the optimal design. For both designs, the elevator activity is 
modest when compared to the aileron activity. The FMC design for flight condition 6 
showed similar results for control surface activity. Both designs exceeded the damping 
ratio requirement for the flutter mode of f >0.015. 



KF FMC gam 

KGW GLAgam 

^COL control column deflection, deg 
6g elevator deflection, deg 

6q^I outboard aileron deflection, inboard segment, deg 

^OAO outboard aileron deflection, outboard segment, deg 

6 pitch rate, deg/s 

• 2 2 
z sensor normal acceleration at eg, m/s (ft/s ) 

. .^9 2 2 

z wing normal acceleration at sensor No. 1 1 , m/s (ft/s ) 

w 



Fiiqht (.ontlition 

2 

4 

6 

KGW 

0 00189 
(0 006188) 

0 00105 
(0 003438) 

0 0 

KF 

0 00349 

0 00349 

00125 

(0 01146) 

(0 01146) 

(0 04097) 


Figure 138. Block Diagram of Classical Control Law Design 
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Table 61. Random Gust Response Comparison, Flight Condition 2 
(a) Incremental Load Reduction (Percent of Open Loop) 


Design 

Gust 

Inboard bending 
moment, ?? = 0.25 

Outboard bending 
moment, r? = 0.75 

Inboard torsion, 
j? = 0.25 

Optimal 

Von 
Karma n 

71.2 

65.6 

91.2 

Dryden 

68.5 

61.9 

87.4 

Classical 

Von 

Karman 

70.4 

61 .9 

101.0 


(b) Control Surface Activity 


Design 

Gust 

Elevator 

deflection, 

deg 

Elevator rate, 
deg/s 

Outboard aileron 
deflection , deg 

Outboard aileron 
rate, deg/s 

Optimal 

Von 

Karman 

1.25 

9.90 

1.88 

24.1 

Dryden 

1.27 

8.88 

1.79 

20.0 

Classical 

Von 

Karman 

1.00 



6.16 

5.29® 

4.53^* 

71.0® 

33.6^ 


^Inboard segment of outboard aileron 
^Outboard segment of outboard aileron 
• Gust intensity = 8.5 m/s (28 ft/s) 
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Table 62. Random Gust Response Comparison, Flight Condition 4 

(a) Incremental Load Reduction (Percent of Open Loop) 


Design 

Gust 

Inboard bending 
moment, r? = 0.25 

Outboard bending 
moment, Tj = 0.75 

Inboard torsion, 
t? = 0.25 

Optimal 

Von 

Karman 

76.7 

63.2 

92.7 

Dryden 

73.7 

59.8 

92.0 

Classical 

Von 

Karman 

81.3 

63.4 

89.3 


(b) Control Surface Activity 


Design 

Gust 

— 1 
Elevator deflection, 
deg 

Elevator rate, 
deg/s 

Outboard aileron, 
deflection, deg 

Outboard aileron 
rate, deg/s 

Optimal 

Von 

Karman 

1.03 

10.5 

1.99 

31.0 

Dryden 

1.02 

9.05 

1.86 

25.2 

Classical 

Von 

Karman 

0.802 

6.32 

5.26^ 

4.13*^ 

79.9® 
31. l'^ 


^Inboard segment of outboard aileron 
^Outboard segment of outboard aileron 
• Gust intensity = 6.4 m/s (21 ft/s) 


Table 63. Random Gust Response Comparison, Flight Condition 6 
(a) Control Surface Activity 


Design 

Gust 

Elevator deflection, 
deg 

Elevator rate, 
deg/s 

Outboard aileron 
deflection, deg 

Outboard aileron 
rate, deg/s 

Optimal 

Von 

Karman 

0.438 

4.23 

1.68 

33.0 

Dryden 

0.443 

3.70 

1.44 

27.0 

Classical 

Von 

Karman 

0.318 

2.84 


250.0® 

33.0*^ 


(b) Damping Ratio of Flutter Mode 


Optimal 

design 

0.027 

Classical 

design 

0.022 


^Inboard segment of outboard aileron 
*^Outboard segment of outboard aileron 
• Gust intensity = 4.3 m/s (14 ft/s) 
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Comparisons provided in Tables 64, 65, and 66 show the response of each design to a 
discrete gust. As in the case of random gust response, the classical design requires 
considerably higher aileron deflection and rate to achieve comparable load reduction. 
Similarly, the optimal design requires greater elevator activity. However, in both cases 
the control demand on the elevator is considerably less than the demand on the aileron. 


Table 64. Discrete (1-cos) Gust Response Comparison, Flight Condition 2 
(a) Incremental Load Reduction at Peak (Percent of Open Loop) 


Design 

Inboard bending 
moment, tj = 0.25 

Outboard bending 
moment, T) = 0.75 

Inboard torsion, 
1) =0.25 

Optimal 

90.2 

67.0 

107.0 

Classical 

85.4 

70.3 

116.0 


(b) Control Surface Activity 


Design 

Elevator deflection. 

Elevator rate. 

Outboard aileron 

Outboard aileron 

deg 

deg/s 

deflection, deg 

rate, deg/s 

Optimal 

8.29 

58.7 

10.6 

106.0 

Classical 

5.30 

35.1 

21.9® 





21.6° 



a 

b 


Inboard segment of outboard aileron 
Outboard segment of outboard 


• Gust intensity = 28.5 m/s (93.4 ft/s) 
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Table 65. Discrete (1-cos) Gust Response Comparison, Flight Condition 4 
(a) Incremental Load Reduction at Peak (Percent of Open Loop) 


Design 

Inboard bending 
moment, 7? = 0.25 

Outboard bending 
moment, tj = 0.75 

Inboard torsion, 
77 =0.25 

Optimal 

95.0 

60.1 

118.0 

Classical 

96.7 

69.2 

120.0 


(b) Control Surface Activity 


Design 

Elevator deflection, 
deg 

Elevator rate, 
deg/s 

Outboard aileron 
deflection, deg 

Outboard aileron 
rate, deg/s 

Optimal 

6.73 

52.7 

10.4 

107.0 

Classical 

4.36 

33.6 

18.4® 

1 74.0® 




18.8^ 

112.0^ 


a 

b 


Inboard segment of outboard aileron 
Outboard segment of outboard aileron 
Gust intensity = 20.9 m/s (68.4 ft/s) 


Table 66. Discrete ( 1-cos) Gust Response Comparison, Flight Condition 6 
(a) Incremental Load Reduction at Peak (Percent of Open Loop) 


Design 

Inboard bending 
moment, 77 = 0.25 

Outboard bending 
moment, 77 >= 0.75 

Inboard torsion, 
77 = 0.25 

Optimal 

104.0 

81.3 

111.0 

Classical 

109.0 

65.1 

149.0 


(b) Control Surface Activity 


Design 

Elevator deflection, 
deg 

Elevator rate, 
deg/s 

Outboard aileron 
deflection, deg 

Outboard aileron 
rate, deg/s 

Optimal 

1.71 

14.3 

4.73 

60.2 

Classical 

1.01 

6.73 

32.6® 

11.7*^ 

1 20.0® 
75.9^ 


a 

b 


Inboard segment of outboard aileron 
Outboard segment of outboard aileron 


• Gust intensity = 9.8 m/s (32.2 ft/s) 
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13.0 PITCH AUGMENTATION CONTROL LAWS 


The pitch-augmented stability (PAS) system was designed using modern optimal control 
theory. Full-state feedback systems were designed for two flight conditions. 
Subsection 13.1 describes the state models for the airplane, actuator, Dryden wind model, 
and ideal airplane model used for the control design and then describes the formation of 
the composite state model incorporating all four of the separate state models. 

In Subsection 13.1, time responses for step elevator commands are shown for the unstable 
open-loop airplane at the two flight conditions. The full-state design process using linear 
quadratic regulator theory with explicit model-following is described in Subsection 13.3. 
This subsection presents closed-loop analysis of selected feedback controllers and the 
resulting closed-loop poles. Time responses to step elevator commands as well as gust 
covariances are shown. Subsection 13.4 compares the performance of the optimal control 
design with the classical control design. 

13.1 DYNAMIC MODEL DESCRIPTION 

This subsection describes the state models and output models used for analysis and 
simulation. 


13.1.1 STATE MODELS FOR AIRPLANE 

Full-state feedback designs were completed for two flight conditions designated as flight 
conditions 58 and 97, respectively. These flight conditions and the corresponding state 
models are defined as follows. 


Flight Condition 58— This is at high altitude with an aft center of gravity and is defined by 
the following parameters; 


Altitude, h 
Mach number 
Speed, V 

Gross mass (weight) 
Center of gravity 


11 125m (36 500 ft) 
0.65 

192 m/s (629 ft/s) 

122 000 kg (270 000 lb) 
0.46c 
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The state model, in stability axes, is given by the following equation: 


ii 

a. 

q 

0 


-5.04 X 

10"^ 

12.85 

0.422 

-32.2 

-1.85 X 

10-4 

-0.388 

0.996 

1.88 X 

-5.39 X 

10-4 

0.413 

-0.276 

0 

0 


0 

1.0 

0 

6.3 1 X 

10-^ 




-2.2 X 
-1.16 

10-2 




0 

_ 





^-5 


u 

a 

q 

d 


( 25 ) 


where 5^ is the elevator angle. 
The eigenvalues are: 

0.367 

-1.1 X 10'^ + 13.17 X 10“^ 
-0.973 


Flight Condition 97— This is a flaps-down approach condition with the following 
parameters: 


Altitude, h 
Mach number 
Speed, V 

Gross mass (weight) 
Center of gravity 


10 668m (35 000 ft) 
0.378 

112 m/s (368 ft/s) 

90 720 kg (200 000 lb) 
OMc 


The state model, in stability axes, is given by the following equation: 
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ii 


-2.16 X 10"2 

20.87 -2.3 X 10“^ 

-32.2 


— — 

u 

a 

- 

-4.76 X 10“"^ 

-0.348 0.994 

-5.87 X 10"^ 


a 

q 


-7.13 X 10"^ 

1.95 X 10"2 -0.256 

0 


q 

_9_ 


0 

0 1.0 

0 


d 

L J 


+ 


6=88 X 10"4 

- 2.21 X 10"2 

-0.56 

0 


( 26 ) 


The eigenvalues are: 
0.0763 

-0.128 + i0.126 
-0.447 


13.1.2 ACTUATOR MODEL 



The model for the actuator is given in transfer function form as 


G(s) = 


! 

(s/20 + !)(s/40 + 1) 


(27) 


This is a second-order model with poles at 20 and 40 rad/s and is essentially the same 
actuator used for the flutter and gust analyses (see fig. 123). The state model selected to 
represent this transfer function in the time domain is 





-40 

0 


’«e' 

+ 

40 



20 

-20 


^E 


0 

— 





^ _ 


_ ^ 



where 


(28) 


= elevator angle 
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intermediate state variable 


6n = elevator command to actuator 
E 

c 

A block diagram for this model is shown in Figure 139. The nomenclature that will be 
used to describe this model as part of the combined state model is 


X 


u 



A 


u 


-40 0 

20 -20 


B 


u 



so that equation (28) can be written compactly as 


The matrix C referred to in the simulation sections is defined as 
u 

Cu =[» '] 


(29) 


(30) 


(31) 


(32) 


(33) 


13.1.3 DRYDEN WIND MODEL 

This subsection briefly describes the Dryden wind model used for flight conditions 
58 and 97. The wind model is described in greater detail in Volume 11, Appendix E, 
Subsection E.1.5. 



1 

5,, 

1 



s/40 + 1 


s/20 + 1 

. 


Figure 139. Cascade Representation of Transfer Function 
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For flight condition 58, the model is 


■“g‘ 


“-0.629 

0 


0 


“g 


= 

0 

0 

- 

0.396 


^w2 

-g 


0 

1 

- 

1.26 


'^g 



* 



- 


L ^ J 



1.12 

0 





+ 

0 

0.499 






0 

1.37 


Wn 



where 


u = longitudinal gust velocity 

O 

= intermediate state for vertical gust velocity 
w = vertical gust velocity 

O 

u^ = white noise input for horizontal gust 

Wn = white noise input for vertical gust 

For flight condition 97, the model is 


"^g' 


“-0.377 0 

0 ■ 



^w2 

= 

0 0 

-0.142 


’^w2 

w 

g 


0 I.O 

-0.754 


w 

_ g 


0.434 

0 

0 


0 

0.231 

1.06 


w. 


The wind model equation can be written compactly as 


w 


^w^w ^ ^w"^ 


(34) 


(35) 


(36) 


Mw 


= C* X 

w 


(37) 
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where 


“g ^w2 "'g ] 

^ [“n'^n] 

Vw " [^g'^g] 

'l 0 o' 

" [o 0 I 

13.1.4 IDEAL AIRPLANE MODEL FOR EXPLICIT MODEL-FOLLOWING 


(38) 

(39) 

(40) 


(41) 


The philosophy and procedure of explicit model-following is described in Sub- 
section 13.3.1. 


For full-state feedback design, the model equations can be summarized in the form 


m 




(42) 


where A is the 4x4 coefficient matrix. The elements of A are discussed in Sub- 
m m 

section 13.3.1. 


The state vector x is 
m 


'm 




m 

m 

m 


where 

u^ = incremental forward velocity of model 
= incremental angle of attack of model 
q = incremental pitch rate of model 
0^ = incremental pitch angle of model 


(43) 
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13.1.5 COMBINED STATE MODEL 


The airplane model, actuator model, wind model, and ideal airplane model are combined 
to form one large state model with 13 state variables. The state vector, x, is defined as 


- rxTvT'xT’x'rl 

= l^u, a, q, 0, 5£', 6£, Ug, x^2> “m> ‘^itv j 


(44) 


The state equations can be written compactly as 


X = Ax + Bju^. + B2W 


(45) 


The system coefficient matrix. A, is defined as 


A = 


0 A, 


^a^w ^ 


u 


0 

0 


'w 

0 


0 

0 

A 


m 


(46) 


where 0 represents a zero matrix, and F is a matrix of coupling coefficients representing 
the effect of wind on the airplane states. Also, 


|T= [0 bJ 0] 


B2^ = [0 0 B 


] 


(47) 

(48) 
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The A matrix for flight condition 58 is 


-5 04x 10"5 

12 85 

0 422 

-32 2 

0 

6 31 X 10-3 

-5 04 x 10"^ 

0 

2 04x 10"^ 

-1 85 X I0-* 

-0 388 

0 996 

1 88 X 10-5 

0 

-2 2 X 10-3 

-1 85 X 10-^ 

0 

-6 nx 

-5 39 X I0-* 

0413 

-0 276 

0 

0 

-1 16 

-5 39x 10-^> 

0 

6 57 X lO-"* 

0 

0 

1 0 

0 

0 

0 

0 

0 

0 





-40 

0 

0 

0 

0 





20 0 

-20 0 

0 

0 

0 







-0629 

0 

0 


0 





0 

0 

-0 396 







0 

1 0 

-1 26 


-5 04x10-^ 12 85 0 422 -32 2 

-185x10*^ -0 388 0 996 0 

-157x10"'* -0 464 -0 863 0 

0 0 10 0 


( 49 ) 


The A matrix for flight condition 97 is 


-2 16 X 10"2 

-4 16 X 10“^ 
-7 13 X icr^ 
0 


20 87 
-0 348 
1 95 X 10"- 
0 


-23x 10"- -322 

0 994 -5 87x10"^ 

-0 256 0 

1 0 0 


6 88 X 10" 
-2 2x I0 t2 
-0 56 
0 


I -2 I6x !0‘- 
I -4 76 X 10"^ 


-40 0 
20 0 


0 

•20 0 


-0 377 
0 
0 


0 

0 

0 

0 

0 

0 

0 

0 

I 0 


5 67x 10’- 
-9 46 X I0“* 
5 3x I0’5 
0 

0 

0 

0 

-0 142 
-0 754 


(50) 


i -2 I6x 10-3 

20 87 

-2 3x 10-2 

-32 2 

! -4 76 X 10-'’ 

-0 384 

0 994 

0 

1 -7 I3x 10-5 

-0 148 

-1 152 

0 

I 0 

0 

1 0 

0 


13.1.6 OUTPUT MODEL 

The output model serves two purposes: (1) provides variables to be used as criteria in the 
quadratic cost performance function and (2) provides output variables needed for 
simulation. 


The variable selected for the cost performance index was Oi^^, defined as 


a 


wc 


a + — a 


m 


(51) 
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The output variable used in the simulation was the normal acceleration, n^, defined as 


= w - Vq 
= V (a - q) 


( 52 ) 


The ideal model vertical acceleration, n , was also used for simulation, n is defined 

’ zm’ zm 


as 




(53) 


The C matrix is the matrix of coefficients such that 


For flight condition 58 


y " 


“wc 


zm 


= Cx 


(54) 


c = 


0 1 0 0 0 0 0 0 0 1 59x10"^ 0 -10 0 0 

-0 116 -2440 -2 7 I18xI0‘2 0 -139 0 0 0 0 0 0 0 

0 0 0 0 0000 0 -0116 -244 0 -2 7 118x10'^ 


(55) 


For flight condition 97 


c = 


0 

-0 175 
0 


1 0 

- 12&0 

0 


0 

-2 32 
0 


-2 16 X 10'^ 
0 


0 

-8 11 
0 


0 2 72 X 10-3 

0 0 

0 0 


0 

0 

-0 175 


-1 0 
0 

-128 0 


0 0 

0 0 

-2 32 -2.16 x 10- 


(56) 
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13.2 OPEN-LOOP ANALYSIS 


This subsection presents the characteristics of the unaugmented airplane at flight 
conditions 58 and 97. Root locations and time responses are shown. 

13.2.1 ROOT LOCATIONS 

The eigenvalues for the unaugmented airplane presented in Subsection 13.1.1 are shown 
graphically in Figures 140 and 141. 

13.2.2 TIME RESPONSES 


A block diagram of the unaugmented airplane is shown in Figure 142. The response to a 
step column command at flight condition 58 is shown in Figures 143 through 148. Note 
the rapid divergence due to the unstable short-period root. The response to a step 
elevator command at flight condition 97 is shown in Figures 149 through 154. Note the 
slow divergence due to the unstable root. 


J 1.0 


A 0.8 


4 0.6 


4 0.4 


«/> 

*o 

(0 

w 

v> 

’x 

CO 

2- 

CO 

C 

'S) 

CO 

E 


0.2 


1— K 1 1 L I — 

- 1.0 - 0.8 - 0.6 - 0.4 - 0.2 


XL 

0 


0.2 



Real axis, rad/s 

Figure 140., Eigenvalues of Unaugmented Airplane, Flight Condition 58 
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- 1.0 - 0.8 - 0.6 - 0.4 - 0.2 0 0.2 0.4 

Real axis, rad/s 

Figure 141. Eigenvalues of Unaugmented Airplane, Flight Condition 97 



(b) Transfer Function Fomnulation 



Figure 142. Block Diagram of Unaugmented Airplane for Simulation 
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Incremental forward velocity, u, m/s (ft/s) 



Figure 143. Velocity Response to Step Column Command, 
b(, = 0.1 rad. Flight Condition 58, Open Loop 



Figure 144. Angle-of-Attack Response to Step Column Command, 
= 0.1 rad. Flight Condition 58, Open Loop 
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Incremental pitch angle. 



Figure 146. Pitch-Angle Response to Step Column Command, 
= 0.1 rad. Flight Condition 58, Open Loop 
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Figure 147. Normal Acceleration Response to Step Column Command, 
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Incremental pitch angle, 6 , rad Incremental pitch rate, q, rad/s 




Figure 151. Pitch-Rate Response to Step Column Command, 
Bf.=0.1 rad. Flight Condition 97, Open Loop 



Figure 152. Pitch- Angle Response to Step Column Command, 
= 0.1 rad. Flight Condition 97, Open Loop 
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-20 -j 

0 5 

Time, sec 

Figure 153. Normal Acceleration Response to Step Column Command, 
8^ = 0. 1 rad, Flight Condition 97, Open Loop 



Time, sec 


Figure 154. Elevator-Angle Response to Step Column Command, 
8f. = 0.1 rad. Flight Condition 97, Open Loop 
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13.3 CONTROL LAW SYNTHESIS 


Linear quadratic regulator theory was used to produce a full-state feedback design. The 
methodology of linear quadratic design, discussed in Volume II, Appendix E, Section E.6.0, 
requires the selection of penalty weighting matrices Q and R in the cost function 

oo 

J = ^ + u^RuJ dt (57) 

o 

where y^ = vector of criteria variables. Selecting as criteria variables states or linear 
combinations of states such as normal acceleration may not always produce the best 
system designs. In the design process for the PAS system, traditional criteria did not 
produce acceptable designs for the two flight conditions in question. For that reason, 
explicit model-following was used to obtain acceptable performance. 

13.3.1 EXPLICIT MODEL-FOLLOWING 

The technique of explicit model-following not only produces criteria for the quadratic 
cost function but also directly produces a feedforward control law. 

The method consists of placing an ideal model of the plant to be controlled in the forward 
path of the control loop, as shown in Figure 155. 


Disturbances 



Figure 155. System Using Explicit Model- Following 
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The ideal model is a fourth-order model of the airplane with the desired response 
characteristics. Its state vector, is given by 


and its state equation is 


'm 


u 


m 

“m 

^IlTl 


(58) 


m 


- + B,^6^ 


(59) 


The result of this formulation is that a control command at the column is fed to a filter 

that produces an ideal response, x^. The rest of the system attempts to follow this 

response by minimizing the difference between x^ and x^. In effect, the system is taking 

X as a command and is minimizing certain components of (x - x^) depending upon how 
rn a. m 

the cost criteria are defined. The ideal model, shown in Figure 155 and defined by 
equation (59), acts as a feedforward filter in the control system. 

Formulating the system in this way also reduces sensitivity of the airplane to turbulence, 
as the ideal model is not disturbed by the wind; the regulator action of the system thus 
acts to keep the components of x^ near their nominal values. 

The criterion variable used in the quadratic cost function was defined as 


w 

(X = (^ + — —— cx 

wc V 


(60) 


The sum a + Wg/V is the actual airplane angle of attack relative to the air, and is the 
angle of attack of the ideal model. Linear quadratic regulator design produces a 
controller that will attempt to minimize during flight. The two state variables that 

primarily affect the short-period response are a and q. It was found that penalizing the 
difference between the actual a and produced the best time responses. 


392 



The ideal model consists of the equations 




^m 1 1 • • • ^m 14 




*’ml 



• 


“m 


bm2 

9m 


• 


9m 

+ 

*^m3 



f m4 1 ^m44_ 




J^m4_ 


or, in vector notation 




(61) 


(62) 


The input matrix B is taken to be the same as B in equation (25) to have the model 
m di 

respond to the command input in a manner analogous to the response of the airplane to 
the elevator angle. In other words, the lags produced by the elevator actuator are ignored 
in the model. This is no real limitation, as the elevator bandwidth is much higher than 
that of the airplane. 


The design process concentrated on the subsystem 



m 


^22 

^m23 


“m 

+ 

•^m2 

m 


^m32 

^m33 


9m 


•51113 


(63) 


to optimize the short-period response. 

The short-period approximation has a transfer function with a first-order numerator and a 
quadratic denominator. Because the pitch-rate response to column commands is of 
primary concern, the pitch-rate transfer function was developed from equation (63) and is 

— (64) 

Aj,(s) s - (am22'^am33) ^ + (^m22am33'^m23^m32> 
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where Q^(s) and are the Laplace transforms of and 6^(t), respectively. 

Comparing this transfer function with a general one of the form 


(cj2 /a) (s+a) 
G(s) “ ~2 T7 2 


(65) 


it develops that 


^m22 “ 


( 66 ) 


^m23 


(67) 


^m32 




( 68 ) 


a^33 =03-2)rco„ (69) 

where 

P = a/fca„ (70) 

The selection of a ^^3 ^ not arise from equation (65) but arises from flight 

dynamics considerations. In fact, 3^23 was taken to be equal to the actual values of a 2 -j 
for the two flight conditions, these values being very nearly 1. The purpose of this 
formulation is to select physically reasonable values of a^ 22 ’ ^m23’ ^m32’ ^m33 

produce a desirable pitch-rate response. 

Values of p, f , and were selected from standard curves relating these parameters to 
percent overshoot of the response to a step input and damping and natural frequency 
requirements of the design requirements and objectives (DRO). 

The remaining elements of A^, relating to the phugoid response, were taken equal to 

those of A . 

a 
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13.3.2 IDEAL MODEL FOR FLIGHT CONDITION 58 


Flight condition 58 is a high-altitude, cruise-phase portion of the flight envelope. Under 
these conditions, it is considered desirable for the pitch-rate response to be underdamped 
and for the normal acceleration to be approximately critically damped. The pilot 
perceives the response of the airplane to column commands in terms of normal 
accelerations at this type of flight condition. 

The ideal model was chosen to produce approximately a 50% overshoot for q^. Param- 
eters that produce this response are 


p = 0.62 

(71) 

f = 0.7 

(72) 

= 0.89 

(73) 

The values of f and fall within the DRO requirements 

^ > 0.35 

(74) 

0.8 < < 5.0 

(75) 


for this flight condition. 

The ideal model matrix for flight condition 58 is 


r ^ 

-5.04 X 10'-^ 

12.85 

0.422 

-32.2 


-1.85 X 10"^ 

-0.388 

0.996 

0 

(76) 

-1.57 X 10"^ 

-0.464 

-0.863 

0 


0 

0 

1.0 

0 
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The responses of and n^^ to a step command 6^ = 0.1 rad are shown in Figures 156 
and 157. 


13.3.3 DESIGN FOR FLIGHT CONDITION 58 


A large portion of the design process consisted of the analysis described in Sub- 
section 13.3.2. The remainder of the design process consisted of selecting the cost 
weighting matrices Q and R to be used in the cost function given in equation (57). 

The value for R was arbitrarily taken to be 1.0, and Q(a^^) was varied to produce 
different feedback designs. The criteria used to judge the quality of the designs were: 


O 


Closed-loop root locations 
Feedback gain magnitudes 
Response to step column command 

Intensity of airplane response to transverse random turbulence 


•o 


£ 

cr 


x: 


O) 

O 

E 


c 

E 

E 

o 

c 



Figure 156, Pitch-Rate Response of Ideal Model, 
b^ = 0,1 rad. Flight Condition 58 
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Figure 157. 


Normal Acceleration Response of Ideal Model, 
d^ = 0.1 rad. Flight Condition 58 


Figure 158 shows a root locus of the closed-loop phugoid roots, and a locus of the closed- 
loop short-period roots is given in Figure 159. 


Gain matrix elements for different values of Q(a^^) are shown in Table 67. Table 68 
shows the responses of system variables to 3.28-m/s (1.0-ft/s) root-mean-square 
transverse random turbulence for the different values of 


The design selected for flight condition 58 is that for which Q(a ) = 5. The responses of 
pitch rate and normal acceleration to a step column command of 0.1 rad are shown in 
Figures 160 and 161, respectively. The elevator response is shown in Figure 162. It can 
be seen that the shapes of the pitch-rate and acceleration responses are almost identical 
to those of the ideal model shown in Figures 156 and 157. 
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Figure 159. Short-Period Roots as a Function of Q Flight Condition 58 


398 



399 



























Table 68. Root-Mean-Square Responses to Transverse Random Turbulence of 3.28-m/s (1.0-ft/s) 


RMS, Flight Condition 58 


Q'(a ) 
' wc' 

u, m/s (ft/s) 

a, rad 

q, rad/s 

6, rad 

6g, rad 


1 

1.3 X 10"'' 
(4.26 X 10"'') 

5.57 X 10'^ 

2.56 X lO"'' 

1.26 X 10"^ 

3.62 X 10"^ 

1.66 X 10"^ 

2 

1.51 X 10'^ 
(4.95 X 10"’) 

5.89 X 10'^ 

2.59 X 10"“* 

1.34 X 10"^ 

4.69 X 10"'' 

2.44 X 10"^ 

3 

1.65 X 10"’' 
(5.42 X 10"'') 

6.15 X 10"'' 

2.80 X 10"^ 

1.42 X 10"^ 

5.62 X 10"'' 

3.11 X 10"^ 

5 

1.84 X 10"'' 
(6.05 X 10"'') 

6.54 X 10"^ 

3.29 X 10"^ 

1.54 X 10‘^ 

7 20x 10"'' 

4.29 X 10"^ 

7 

1.97 X 10"'' 
(6.47 X 10"'') 

6.83 X 10"^ 

3.75 X 10"'^ 

1.62 X 10"^ 

8.54 X 10"'' 

5.32 X 10"^ 

10 

2.11 X 10"' 
(6.92 X 10"'') 

7.16 X 10"'' 

4.36 X 10"'' 

1.72 X 10"^ 

1.03 X 10"^ 

6.69 X 10"^ 





Time, sec 

Figure 160. Pitch-Rate Response to Step Column Command, 
5^ = 0.1 rad. Flight Condition 58, Closed Loop 
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Elevator angle, Sc, rad 


Time, sec 

Figure 161. Normal Acceleration Response to Step Column 
Command, 5 ^ = 0 . / rad. Flight Condition 58, 
Closed Loop 





13.3A IDEAL MODEL FOR FLIGHT CONDITION 97 


Flight condition 97 is a flaps-down approach portion of the flight envelope. Under these 
conditions, it is considered desirable for the pitch-rate response to be much less 
underdamped than for a cruise condition. The pilot perceives the response of the airplane 
to column commands in terms of pitch rate at this type of flight condition. 

The ideal model was chosen to produce approximately a 10% overshoot for q^. 
Parameters that produce this response are 


a 

= 0.5 

(77) 


= I.O 

(78) 


= 0.768 

(79) 


This low value of was required to produce the desired response. Even though this 
value for the model is below that required for the airplane, it produces acceptable short- 
period roots for the closed-loop airplane. 


The ideal model matrix for flight condition 97 is 


-2.16 X 

o 

1 

20.87 

-2.3 X 1 0-2 

-32.2 

-4.76 X 

10-4 

-0.384 

0.994 

0 

-7.13 X 

10~^ 

-0.148 

-1.152 

0 

0 


1.0 

0 

0 


The responses of q and n to a step command 5 = 0.1 rad are shown in Figures 163 and 

16 ^. 
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Normal acceleration, n , m/s"^ (ft/s' 


0.045 r- 



Figure 163. Pitch- Rate Response of Idea! Model, 
8^ = 0.1 rad. Flight Condition 97 



Figure 164. Normal Acceleration Response of Ideal Model, 
5^ = 0. 1 rad, Flight Condition 97 
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13.3.5 DESIGN FOR FLIGHT CONDITION 97 


As for flight condition 58, the value of R was taken to be 1.0, and Q(o! ) was varied to 

wc 

produce different feedback designs. A root locus of the closed-loop phugoid roots is given 
in Figure 165, and a locus of the closed-loop short-period roots is given in Figure 166. 

Gain matrix elements for different values of Q(a ) are shown in Table 69. Table 70 

WC.. 

shows the responses of system variables to 3.28-m/s (1.0-ft/s) root-mean-square 

transverse random turbulence for the different values of Q(a ). 

w c. 

The design selected for flight condition 97 is that for which Q(a^^) = 10. The responses 
of pitch rate and normal acceleration to a step column command of 0.1 rad are shown in 
Figures 167 and 168, respectively. The elevator response is shown in Figure 169. 



Real axis, 10 rad/s 


Figure 165. Phugoid Roots as a Function of Q Flight Condition 97 
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Real axis, rad/s 


Figure 166. Short-Period Roots as a Function of Q 
Flight Condition 97 
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Table 70. ' Root-Mean-Square Responses to Transverse Random Turbulence of 3.28 -m/s (1.0-ft/s) 


RMS, Flight Condition 97 


Km 

u, m/s (ft/s) 

a, rad 

q, rad/s 

d, rad 



1 

1.44 X 10" \ 
(4.73 X 10'b 

1.76 X 10'® 

1.89 X 10'^ 

6.99 X 10'® 

1.67 X 10'^ 

8.42 X 10'^ 

2 

1.94 X 10'^ 
(6.35 X lO"'') 

1.76 X 10'® 

2.72 X 10'^ 

9.71 X 10'® 

3.40 X 10'^ 

3.44 X 10'® 

3 

2.18 X 10'] 
(7.14 X 10'^) 

1.83 X 10'® 

3.26 X 10'^ 

1.11 X 10'® 

5.35 X 10'^ 

7.39 X 10'® 

5 

2.39 X 10"'' 
(7.83 X lO'”') 

1.95 X 10'® 

4.05 X 10'^ 

1.23 X 10'® 

9.79 X 10'^ 

1.83 X 10'® 

7 

2.47 X 10'”' 
(8.09 X 10"'') 

2.05 X 10'® 

4.68 X 10'^ 

1.29 X 10'® 

1.47 X 10'® 

3.22 X 10'® 

10 

2.50 X 10'^ 
(8.19 X 10"'') 

2.17 X 10'® 

5.48 X 10'^ 

1.32 X 10'® 

2.27 X 10'® 

5.71 X 10'® 

20 

2.44 X 10'] 
(8.01 X 10'') 

2.46 X 10'® 

7.64 X 10'^ 

1.32 X 10'® 

5.21 X 10'® 

1.64 X 10'"* 

30 

2.37 X 10'^ 
(7.76 X 10"''' 

2.66 X 10'® 

9.42 X 10'^ 

1.30 X 10'® 

8.30 X 10'® 

2.92 X 10'^ 

50 

2.24 X 10''' 
(7.36 X 10''') 

2.92 X 10'® 

1.23 X 10'® 

1.27 X 10'® 

1.46 X 10'® 

5.91 X 10'^* 

100 

— 

2.07 X 10’'' 
(6.79 X 10"') 

3.29 X 10'® 

1.78 X 10'® 

1.22 X 10'5 

3.01 X 10'® 

1.46 X 10'^ 



Time, sec 

Figure 167. Pitch- Rate Response to Step Column Command, 
bf. = 0.1 rad. Flight Condition 97, Closed Loop 
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Figure 168. Normal Acceleration Response to Step Column 
Command, S^ = 0.1 rad. Flight Condition 97, 
Closed Loop 
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Figure 169. Elevator- Angle Response to Step Column Command, 
= 0.1 rad. Flight Condition 97, dosed Loop 
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13.4 COMPARISON WITH CURRENT TECHNOLOGY CONTROL LAWS 


Comparison of the system designed using modern control theory and that designed using 
classical methods shows that both methods produce acceptable responses to column 
commands. The responses of the classical system for flight conditions 58 and 97, shown in 
Figures 170 and 171, are rapid and have no overshoot. Comparison of Figure 170 with 
Figure 160 indicates that the optimal system has a faster rise time and reaches steady 
state more rapidly for flight condition 58. The optimal system has about a 50% overshoot, 
which was designed to produce rapid normal acceleration response. 

Comparison of Figure 171 with Figure 167 indicates that the two systems have approx- 
imately the same speed of response at flight condition 97; the optimal system has a small 
overshoot. 

An advantage of the optimal control method is that it allows the type of response desired 
to be directly selected by specifying an ideal model having that response. The optimal 
control design process then directly produces the feedback gains required to cause the 
augmented airplane to behave similar to the ideal model. The method allows the designer 
to design for acceptable responses to command inputs as well as turbulence inputs. 



Figure 170. Pitch-Hate Response to Step Column Command, 

8f. = 0.1 rad. Flight Condition 97, Classical Feedback 
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Incremental pitch rate, q, 





Figure 171. 


Time, sec 

Pitch-Rate Response to Step Column Command, 

= 0.1 rad. Flight Condition 58, Classical Feedback 
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14.0 1990 ACT SYSTEM STUDY SUMMARY 


This section assesses the effect of advancing technology in the electronic and automatic 
control areas on the cost of ownership of an Active Controls Technology (ACT) airplane. 
More specifically, the effects of the technology advances associated with the implemen- 
tation of an ACT system that embodies properties and characteristics expected to be 
available for a circa 1990 commercial airplane are evaluated. Additional information is 
contained in Volume II, Appendix G, "Alternative Implementation of ACT." 

Figure 172 shows the study tasks that comprise the advanced technology ACT system 
definition. A familiarization phase was followed by a flight control system element study. 
This study examined the technology developments in various automatic flight control 
areas and projected the developmental status to the late 1980s. Based on these 
projections, a study of alternative systems was begun. Three alternative systems were 
defined and examined qualitatively for their advantages. Actuation studies were 
conducted separately to define actuators that would be used with the final system. 



Figure 172. Advanced Technology ACT System Study Elements 
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Following the alternative systems study, a 1990 implementation of ACT was defined based 
on the previous work. Flight safety reliability was predicted, and cost-of-ownership 
parameters were estimated. These parameters were then entered into the Boeing cost 
model, and fuel savings (during the system payback period) and return on investment (ROl) 
were calculated. The advanced technology system provides an ROl to the airlines of 
34.9% compared to a maximum ROl of 27.6% for current technology systems (see 
subsec 14.3.4). 


14.1 FAMILIARIZATION AND DATA ASSEMBLY PHASE 

A familiarization phase was required for the Honeywell engineers involved in the project 
so that they could learn how past work applied to the Advanced Technology ACT Control 
System Definition. ACT functions were defined during this phase, including input signal 
requirements, control laws, and surfaces to be controlled. The control-surface hinge 
moments, maximum deflections, and rates were defined as were the dynamic response 
requirements for the actuators. Slats, flaps, and spoiler control and actuation were 
separated from the advanced technology ACT study because no change is required of 
these characteristics from the Baseline definition. Fly-by-wire (FBW) control was defined 
as an option for the 1990 ACT system, but any associated effect on cockpit controls, 
including the angle-of-attack limiting function actuator, was not addressed to avoid 
dilution of the basic 1990 ACT study effort. The aircraft electric and hydraulic systems, 
as modified for ACT (subsecs 8.3 and 8.6), were prescribed as applicable to the 1990 ACT 
system. 


14.2 FLIGHT CONTROL SYSTEM ELEMENT STUDY 

Applicable developments were surveyed, and forecasts were prepared to better identify 
elements appropriate to a 1990 operational system. Sensors, computers, servoactuators, 
and software design and validation were the areas surveyed. 

14.2.1 SENSOR SURVEY 

The sensor survey included air data, angular rate, and acceleration sensors. Based on the 
sensor requirements of the ACT system, it was concluded that air data information should 
be obtained from the aircraft air data system and that three digital air data computers 
(DADC) should be required. Data obtained in this manner are adequate in the area of 
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performance. Triplex sources of air data information provide adequate functional 
reliability. This is the most economical manner of acquiring the required air data because 
the DADCs also are required for other aircraft avionic subsystems. 

When angular rate sensors were surveyed, many present and evolving concepts were found 
to be satisfactory in performance and reliability. The ring laser gyro is recommended for 
the ACT application because there is no mechanical wear associated with the gyro and 
because this type of gyro will be required aboard the aircraft for the triplex inertial 
reference system (IRS) function. 

The IRS accelerometer output signals are recommended for the required normal acceler- 
ation signal. The piezo-resistive strain gage is recommended for wing-mounted acceler- 
ometers required for flutter-mode control (FMC) and wing-load alleviation (WLA). These 
accelerometers are relatively low cost and have a high dynamic response. Filters can be 
applied to limit the bandwidth of the signals. 

The roll attitude signal required for lateral/directional-augmented stability (LAS) is 
satisfactorily obtained from the triplex IRSs. 

14.2.2 AIRBORNE COMPUTER TECHNOLOGY 

A dramatic increase of capability will be experienced in computing over the next several 
years. This will be due mainly to very-large-scale and very-high-speed integrated circuit 
developments. 

Ultrareliable central processing components will be available in the late 1980s to meet 
the needs of digital calculations for flight controls. This reliability will be the result of 
increased integration. Chip counts and connections between chips will be significantly 
reduced. Fault-tolerant and self-testing mechanisms will be included in the chips. The 
size, weight, and power requirements of the systems will no longer be significant 
considerations, and costs will be reduced to relatively unimportant levels. 
Standardization of instruction sets will permit accumulation of software support systems 
and development tools so that software development for flight control calculations will be 
economical and certifiably reliable. This will be enhanced by the trend to use hardware 
rather than complicated software for fault tolerance and self-checking. 
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The input/output (I/O) functions, already the main part of the system design problem, will 
become even more dominant as the central computing structures become routine. 
Multiplexed busing of sensor data and actuator commands will present the critical 
technical problems. Fault-tolerant components, which will provide more capability than 
is necessary for flight controls, will be used in these systems because of large production 
runs and experience in similar systems. 

14.2.3 ACTUATORS 

Actuation concepts were reviewed and compared to requirements, which resulted in the 
conclusion that conventional hydraulic actuation concepts should be applied for the 1990 
ACT system. The alternatives included various higher efficiency techniques such as 
servopumps, which were questionable in performance for the applications of the ACT 
configuration. 

Electromechanical actuators (EMA) were identified as the type to be used for flaperon 
control. They use electric input power and thus minimize the difficulty of transmitting 
power across the flap-wing interface. EMAs were not considered for other applications 
because so much effort would have to be expended to properly consider them due to their 
overall effect on the aircraft electric and hydraulic power systems. Although it is beyond 
the scope of this study, the impact that EMAs have in these specific areas is being studied 
in other programs. 

14.2.4 SOFTWARE DESIGN 

As a result of examining software design developments, it is projected that methodologies 
will be available by 1990 so that software can be designed and validated for flight control 
applications and can be certified to be error free. Flight controls have a regular structure 
that can be the basis for specification, design, coding, verification, and validation. Many 
variants of a systematic methodology can be shaped about this structure. It will be 
possible to develop flight control software that is certifiably free of technical software 
errors and performs according to precisely defined specifications. 
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14.3 ALTERNATIVE SYSTEM CONCEPTS 


14.3.1 INTRODUCTION 

Three alternative advanced technology ACT system configurations were developed. They 
differ in the assumed technology risk, but the ACT requirements and functions are 
identical for all three configurations. The alternatives are characterized as having low, 
medium, and high risk associated with system implementation by 1990. Three alternatives 
of varying risk were formulated so that a single alternative could be selected with 
awareness of the likelihood of the implementation being advanced in concept and yet 
realizable by 1990. 

The three systems have different approaches to the computational elements of the 
systems and the data busing concepts. The sensor sets and actuator approaches are nearly 
the same for each with the exception of an additional pitch-rate sensor requirement for 
the low-risk system. 

The low-risk system follows the developments of the 1970s in that redundant computers 
are run in a macrosynchronized manner. Data are exchanged between the redundant 
computers via dedicated serial buses. Computations are bit-for-bit identical between 
computers because of the redundancy management approach used and the data exchange 
qualities. Sensor and servo interfaces are primarily analog. Only moderate technology 
growth IS assumed, and minimal use of integrated circuit advances is required. 

The medium-risk system uses multiple microprocessors in each computing channel. 
Computer channels operate asynchronously. Serial digital data busing is used extensively 
for both sensor and actuator interfaces. Objectives were to create an increased number 
of success paths for flight safety and dispatch reliability and to reduce software 
complexity and preparation costs. 

The high-risk system capitalizes on recent and projected advances in self-testing digital 
circuitry and in integrated circuit technology. The computational segment of the system 
builds on, and extends, the concepts used in the fault-tolerant multiple processor (FTMP) 
and software-implemented fault tolerance (SIFT) architectures. It consists of four self- 
checking computer modules composed of multiple microprocessors. Each module is 100% 
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self-checking; it does not require cross-channel comparison of the computers. The 
computers run asynchronously, and the system relies on ultrareliable self-checking bus 
adapters and controllers. 

A derivative of the medium-risk system was selected for further evaluation and cost-of- 
ownership analysis. The system is discussed in Subsection 14.5. Additional information on 
the ACT system configurations is in Volume II, Appendix G. 

14.3.2 DESCRIPTION AND COMPARISON OF ALTERNATIVE SYSTEMS 

This subsection describes the three alternative forms of the advanced technology ACT 
system and presents comparative data in tabular form. 

14.3.2.1 Low-Risk System 

The low-risk system is based on the principle of digital FBW control developed during the 
1970s. Moderate extension of large-scale integrated circuit technology is projected. 

The low-risk system is an integrated one in that the crucial pitch-augmented stability 
(PAS) functions are accomplished by the same computers as the critical functions. This is 
also true of the medium- and high-risk systems. Because the pitch axis is already 
dependent upon crucial electronics due to the short-period PAS function, pitch axis 
control can be made FBW without additional risk. 

Figure 173 shows the essentials of the low-risk system architecture. The quadruply 
redundant computers are state-of-the-art uniprocessors. All processing is run in the ACT 
computers. Sensor data are input to the ACT computer in digital and analog form. The 
IRS and DADC inputs are via a serial digital Aeronautical Radio Incorporated (ARINC) 
429 bus. All other sensor inputs and the pitch-rate gyro signals from the IRS are 
hardwired analog. Outputs to both the triple and quadruple servos and actuators are also 
hardwired analog. Servo-loop electronics are contained in the computer. 

The sensor set consists of rates and accelerations from the strapdown IRS, air data from 
the DADC, accelerometers mounted in the wings for gust-load alleviation (GLA) and 
FMC, the pilot input transducer, and an additional pitch-rate sensor. All sensors are 
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tripled with the exception of pilot inputs and pitch rate, which are quadrupled. The 
quadruple pitch-rate configuration is achieved by using three IRS gyros and an additional, 
separate pitch-rate sensor. 

The computers are frame synchronized. Each cycle of computation is initiated 
simultaneously by all computers as a result of the "halt-release" implementation used. 
Data are exchanged between computers via a dedicated serial data bus. Sensor data are 
exchanged and monitored. Signals are related in such a way that control law 

computations are identical in each computer. Each computer has an analog reversion 
mode that allows continued safe flight after loss of all digital computing capability. 
Failure management is accomplished with comparison monitoring. The required reliability 
for the crucial PAS system is achieved through the additional (fourth) pitch-rate sensor. 



• Ailerons 

• Rudder 


Elevator 

secondary 

actuators 



Left and right 
WLA and FMC 
accelerometers 


Electromechanical I 
actuators 

• Flaperons 


Analog 

hardwired 


Pilot control 
transducers 


Figure 173. Low- Risk System 
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14.3.2.2 Medium-Risk System 


The medium-risk system (fig. 174) uses extensive busing and multiple microprocessors. 
All axes are FBW. The system assumes projections of software and integrated circuit 
technologies that have a reasonable probability of being available for system realization 
by 1990. 

The sensor set is the same as for the low-risk system except that no separate pitch-rate 
sensor is provided. A Luenberger observer is used to estimate pitch rates if two of the 
three identical IRS rate gyros fail. Thus, the fourth pitch-rate sensor required for the 
low-risk system can be eliminated. 

The computer architecture differs significantly from the low-risk system in that it is a 
multiple-microprocessor-based system. Each of the four channels, which operate 
asynchronously, has several microprocessors. Each processor performs a specific function 
and each has low loading and simplified software. The sensor processors, located one to 
each sensor, perform analog-to-digital (A/D) conversion and data preparation for insertion 



Figure 174. Medium-Risk System 


418 

























on the digital bus. The I/O processor (one to each ACT computer) performs the basic 
sensor failure management. The I/O processor also outputs the control commands on the 
output data buses. The control law processor does the control computations, and the 
output monitor processor (OMP) performs downstream checks on control command 
validity and failure management of the servos. 

The architecture uses digital serial data buses extensively. There is a set of four buses 
from the sensor processors to the I/O processor, four buses from the I/O processors to the 
OMPs, and three buses from the OMP to the servoprocessors. 

14.3.2.3 High-Risk System 

The high-risk system, shown in Figure 175, is characterized by a quadruple bus set that 
carries both sensor and actuator data. 

All the circuits within the ACT computer are 100% self-checking. With the projected 
processor speed, there is adequate throughput in each computer to perform the ACT 
functions. Redundancy management is simplified as a result of the self-checking 
capability. 

The low-, medium-, and high-risk systems are compared in Table 71. 



Figure 175. High-Risk System 
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Table 71. Alternative System Comparison 


Characteristics 

System features | 

Low risk 

Medium risk 

High risk 

• Sensor set 

•Three 1 RSs 
•Three DADCs 
•Three sets of accelerom- 
eters for WLA and FMC 
• Four pilot input 
transducers 

•One pitch-rate sensor 

• Same as the low- risk 
system without 
pitch-rate sensor 

• Same as the medium- 
risk system 

• Sensor input approach 
• IRS 1 
•DADC J 

• Serial digital bus 
to the ACT computer 

• Serial digital bus 
to I/O processor 

• On common serial 
digital bus 

• Others 

• Failure management 
•Critical functions 

• Crucial functions 

• Hardwired analog 

to the ACT computer 

• Majority vote and 
comparison monitoring 

• Same with fourth 
pitch-rate sensor 

• Same as the low-risk 
system 

• Same with Luenberger 
observer to estimate 

q from n and other 
signals ^ 

• Same as the low- 
risk system 

• Same as the 
medium-risk 
system 

• Bus structure 

• Two bus systems 

• ARINC429 from 
IRS and DADC to 
ACT computer 

• Serial digital data 
exchange between 
computers 

• Three bus systems 
•Quadruple sensors 
to I/O processor 
•Quadruple I/O pro- 
cessor to output 
monitor processor 
•Triplex, output 
monitor processor 
to servos 

• One universal quadruple 
bus system 
• Self-checking 

• Computer system 
•Redundancy 
•Architecture 

• Quadruple 

• Uniprocessors 

• Quadruple 

• Multi microprocessors 

• Sensor 
•I/O 

•Control law 

• Output monitor 

• Servo 

•Quadruple 
• Self-checking 
computing modules 
composed of multiple 
processors 

• Synchronization 

• Failure management 

• Analog backup 

• Frame synchronized 

• Self-check and bit-by-bit 
comparison monitor 

• Yes 

• Asynchronous 

• Output monitor 
processor, comparison 

• No 

•Asynchronous 
•Completely self- 
checking, no comparison 
• No 

• Servos and actuators 

• Servo-loop electronics 

• Command output 
approach 

• Failure management 

• In ACT computers 

• Hardwired analog 

•Monitored in ACT 
computer 

•Hardwired fault correction 

• In dedicated servo 
microprocessor 

• Serial digital buses 

•Quadruple to OMP 
• Triplex OMP to servo 

• Monitored in OMP 

• Fault correction via 
serial bus 

• Incorporated in 
multiprocessor 

• On common serial 
digital bus 

• Monitored in ACT 
computer 

• Fault correction via bus 

• Software charac- 
teristics 

•Complex, 1980 
technology 

• Simplified, segmented 
into microprocessors 
by function, reduced 
redundancy manage- 
ment required 

• More simple because of self- 
checking autonomous chan- 
nels, highly reliable through 
advanced verification and 
validation 

• Reliability assessment 
(probability of failure 
per 1-hr flight for sens- 
ing and computing, 
actuators neglected) 

• 4 X 10“^2* 

• < 10'^^* 

• Not assessed 


'Assumes software reliability and coverage generally equal to 1 0 
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14.4 ACTUATION STUDIES 


Studies were conducted to define the actuators to .be used with the 1990 ACT system. An 
EMA was defined for control of the flaperons. An active, online form of integrated 
hydraulic actuator was defined for each of the other actuation requirements. 

14.4.1 ELECTROMECHANICAL ACTUATOR 


Figure 176 shows the electromechanical flaperon hinge-line actuator. Two dual-wound 
motors power the actuator. The two dual-wound, brushless, permanent magnet motors 
drive a differential gear set that sums the positions of each motor to determine the 
output. 



• 0.76m (30-in) long, 0.1m (4-m) diameter 

• 22-kg (48-lb) actuator assembly 

• Dual-dual motors, velocity summed 

• Dual, power off, brake 

• Passive thermal mass temperature 
control 

• 270V dc power 

• 1 2A (6 each) at stall 

• 1A (0.5 each) at no-load maximum 
rate 


• 4240-N-m (37 500-in-lb) minimum stall 
torque with two of four channels 

• 80-deg/s no load with two motors 

• Capability to hold stall continuously 

• 40-rad/s minimum bandwidth 

• Two-channel fault tolerance 

• -H20° to -68°C (+250° to -90°F) 
operational environment 


Figure 176. Electromechanical Flaperon Hinge-Line Actuator 
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The actuator is controlled by two servodrive electronics units (SDEU) that are sized so 
they may be located within the flap. The SDEUs: 

• Interface with actuator buses 

• Compare actuator deflection with that commanded 

• Commutate the field windings to achieve the desired response 

• Convert 115V, 3-phase ac power to 270V dc power 

• Monitor the actuator performance and correct for faults 

• Report fault status to ACT computer via actuator buses 

The redundancy management enables two failures in any one actuator to be tolerated 
without loss of function so that reliability in excess of the minimum required is achieved. 

14.4.2 ACTIVE, ONLINE INTEGRATED HYDRAULIC ACTUATOR 

The active, online integrated actuator is shown in Figure 177. An integrated actuator was 
selected instead of a secondary actuator and power control unit combination because of 
lower cost, lighter weight, and higher reliability for this FBW application. The active, 
online approach was preferred to alternative integrated actuator concepts for the same 
reasons. Figure 177 illustrates the simplicity of the actuation concept. Three actuators 
operate each elevator control surface where fail-operational/fail-operational controls are 
desired. One of the three is designated as the active cylinder. The other two also follow 
the position command. However, the difference in the cylinder pressures between the 
active cylinder and the online cylinders is fed back to equalize the force outputs. 
Because the equalizing feedbacks are limited to small values, any failure transients are 
almost immediately opposed. Computer monitoring of the actuators bypasses the faulty 
cylinder and redesignates the active channel as necessary. 

Other surfaces are driven by two appropriately sized actuators. The operation is similar 
except that only fail-operational performance is achieved. 

14.5 1990 ACT SYSTEM IMPLEMENTATION 

A derivative of the medium-risk system described in Subsection 14.3.2.2 was selected for 
further evaluation and cost-of-ownership analysis. It is called the 1990 ACT system and 
has the following features; 
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Figure 177. Active, Online Integrated Actuator 




















• Redundant buses are used for sensor-computer and computer-actuator interfaces. 
This saves weight and cost by marked reduction of aircraft wiring and makes all 
sensor data available to all computing channels. 

• Computing is asynchronous between channels and is compartmented such that 
separate microcomputers perform I/O processing, control law computations, and 
redundancy management. This avoids monolithic software structure and results in 
lower costs of software design, validation, and verification. 

• Sensors and actuators have self-contained electric power supplies and bus interface 
circuits. 

• Crucial control law computation load is assumed by the I/O microcomputer if the 
control law microcomputer fails. This adds redundancy and reliability to the crucial 
functions. 

14.5.1 SYSTEM ARCHITECTURE 

The 1990 ACT system is integrated; all functions are performed by each of a central set 
of four ACT computers. Sensors and control surface actuators are shared between 
functions to the extent allowed by the control laws. 

Airplane primary control is FBW; all control surface actuators are signaled electrically, 
and there is no mechanical control system. 

The system architecture is shown in Figure 178. A set of four buses interfaces the sensors 
with the ACT computers. Similarly, a set of four buses interfaces the ACT computers 
with the surface actuators. The ACT Maintenance and Display Computer, warning 
electronics module, and dedicated ACT panel also interface with the computers via the 
same set of four buses associated with the surface actuators. 

The DADC and IRS are airplane sensors that interface with the ACT computers via buses, 
as defined for the aircraft as intersystem buses. The IRS can interface with the ACT 
system via the quadruple intrasystem buses and the intersystem buses. This is necessary 
because the pitch-rate and acceleration signals, used for crucial functions, need to be 
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Figure 178. 1990 ACT System Architecture 
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obtained more reliably and faster than is possible with an intersystem bus presumed to be 
of the ARINC 429 type. 

Each sensor contains bus interface electronics. The interface electronics include an A/D 
converter, an asynchronous serial I/O communications circuit, and the logic required to 
recognize a data request and format the data response for transmission to the computers 
on the sensor bus. Each response includes data, label, and a parity bit. 

Each hydraulic servoactuator contains electronics to receive and decode the serial data, 
convert the command to an analog signal, demodulate the feedback signals required for 
servo control, and close the servo loop. The servoelectronics also transmit signals on the 
bus in response to ACT computer requests, which include the feedback signals required for 
monitoring of the servo. 

The EMAs associated with the flaperons similarly interface with the ACT computers. 
However, each EMA has two SDEUs. Two are needed because the control electronics 
required for the EMAs are considerably more elaborate than those required for the 
hydraulic servos. Much of the EMA monitoring and redundancy management is done in 
SDEUs. 

The ACT Maintenance and Display Computer interfaces with the actuator buses. It 
receives data from the ACT computers indicating the failure state of the active control 
system and provides fault annunciation messages and signals to the caution and warning 
system. 

The ACT discrete display also interfaces with the actuator buses and provides an 
independent source of system failure status information to the crew. The caution and 
warning system discrete displays also interface with the actuator buses. 

14.5.2 FAILURE MANAGEMENT 

Figure 179 is a simplified diagram illustrating the redundancy management used in the 
1990 ACT system. Quadruple (or triple) sensors interface with quadruple ACT computers 
through a set of sensor data buses so that each ACT computer has access to all the 
redundant sensor data. The sensors are monitored, and the actuator commands are 
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computed in ACT computers operating asynchronously with one another. The actuator 
commands are output on quadruple actuator buses to hydraulic actuators and EMAs at the 
control surfaces. Monitor processors contained within the ACT computers monitor 
actuator commands and actuator performance and effect fault correction as appropriate. 

The sensor bus transmits multiplexed sensor data to the four ACT computers. There are 
approximately 20 data inputs to these buses. The transfer rate will approximate 500 
samples per second per sensor. 


Each of the ACT computers includes a bus controller that controls one of the buses. The 
bus controller is dependent only on the computer power supply and clock for its proper 
operation. Loss of a bus or of a controller results in loss of data from sensors on that bus. 
Therefore, highest reliability for each bus and bus controller is of paramount importance. 


Actuator 
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A dead controller or a dead terminal (located with each sensor) will be detected by sensor 
comparison monitoring within the ACT computers and by watchdog timer checks 
associated with the bus controller. 

Parity bit errors will be used to reject specific faulty data transmissions. 

Certain sensor data, typified by air data signals, are transmitted to the ACT computers by 
ARINC 429 buses. Each of the A, B, and C computers receives data from one of the three 
DADCs in this manner at a relatively low sample rate. These data are output on the 
sensor buses by the ACT computers at a rate of 500 samples per second so that each 
computer has access to all three sets of air data. 

The midvalue of the redundant sensor data is determined in each of the four ACT 
computers. The midvalue of four signals is the average of the two middle signals. When 
only two sensors are valid, their average is determined in lieu of a midvalue. 

These sensor data are compared across channels. Discrepancies are used to detect sensor 
failures and isolate the fault whenever possible. When a discrepancy between two valid 
sensors occurs, fault isolation is not attempted in the case of most sensors. Both sensors 
are presumed failed, and the ACT system continues to function in a degraded state, 
normally discontinuing the function associated with the failed sensor type. The pilot 
command transducer and pitch-rate signals, which are essential to safe flight, are treated 
somewhat differently. 

If faults occur in the quadruply redundant pilot command transducers so that a 
discrepancy between the only two remaining signals occurs, a sensor validity signal is used 
to identify the good sensor. Safe flight is continued using this single good sensor. The 
sensor validity signal is obtained by means of circuitry that takes the sum and difference 
signals formed when the linear variable differential transducer (LVDT) secondary center 
tap is grounded. The difference signal is proportional to the transducer signal; the sum 
remains nearly constant for a properly functioning transducer. 

The pitch-rate signal is compared not only with the other pitch-rate signals but, following 
a sequence of failures, is compared with an estimated pitch-rate signal based on normal 
acceleration. 
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The control laws compute the servoactuator commands in each ACT computer. Because 
an asynchronous computation is involved, the servocommands computed by the four ACT 
computers will not agree precisely. Channels are equalized by noting the difference 
between a particular ACT computer servocommand and that associated with the active 
channel. 

Each ACT computer is assigned a particular bus on which it outputs the servocommands. 
The monitor processor compares the servocommands as issued on each bus. Faulty 
servocommands are detected and isolated by the monitor processor using comparison 
monitoring techniques. If three computer failures ever occur, the third computer failure 
is isolated by the computer self-test. The computer self-test confidence is greater than 
95%. Single-channel operation is permitted following a third computer failure because 
there is no apparent better alternative. 

14.5.3 FUNCTIONAL RELIABILITY 

The probability of the FBW, crucial PAS system failing to function during a 1-hr flight 

-12 

was calculated as 1.7 x 10 . The probability of loss of any critical ACT function was 

calculated as 2.7 x 10"^. 

Both estimates are more than an order of magnitude less likely than the functional failure 

9 “5 

probability goals (less than 10“ for crucial functions and less than 10“ for critical 
functions). However, these predictions assume that software reliability and coverage are 
generally equal to 1.0. 

14.5.4 COST-OF-OWNER5HIP EVALUATION 

Cost of ownership for the 1990 ACT system was analyzed and compared with the current 
technology systems. Because cost of ownership depends upon the airplane configuration, 
and the most complete data are available for the Initial ACT Configuration (ref 2), the 
external aerodynamic characteristics and active control functions and surfaces of that 
airplane were assumed. This means that flaperons were not included in the cost-of- 
ownership evaluation. Analysis for the 1990 ACT system was performed based on 
increments from the current technology Selected System, which was analyzed earlier. 
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The 1990 ACT system differs basically from the Selected System as follows; 

• All mechanical connections and components connecting the cockpit flight controls 
to the actuator servovalves are deleted. 

• Mechanical servo feedback to hydraulic power control unit (PCU) servovalves is 
deleted. 

• All ACT secondary servos and two FMC servos are deleted, and their functions are 
assumed by the generally more expensive (but lighter weight) FBW PCUs listed in 
Table 72. 

• Four flight control computers (see table 72) replace the three primary and four 
standby short-period PAS computers of the Selected System. 


Table 72. Advanced Technology Fly-by-Wire Line Replaceable Unit 
Nomenclature, Weight, and Quantity Per Aircraft 


Component 

Quantity per 
shipset 

LRU 

weight, kg (lb) 

ACT computer 

4 

5.4 (12.0) 

Sensors 



• Control position transducer 



• Pitch 

2 

0.9 (2.0) 

• Roll 

2 

0.9 (2.0) 

• Yaw 

2 

0.9 (2.0) 

• Accelerometer, wing FMC 

2 

0.9 (2.0) 

• Accelerometer, wing WLA 

2 

0.9 (2.0) 

Servos 



• Electrohydraulic 



• Outboard aileron inboard 

2 

5.1 (11.2) 

• Elevator 

6 

4.7 (10.4) 

• Rudder 

4 

8.0 (17.6) 

• Outboard aileron outboard 

4 

2.8 (6.1) 

• Inboard aileron 

4 

3.4 (7.6) 
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• Sensors peculiar to the Selected System (and not included in the Baseline) are 
replaced by the more expensive sensors shown in Table 72, which can communicate 
directly to the digital data bus used for signal transmission. The digital sensors 
added for stabilizer, flap, and slat position have not been included because this 
information is hardwired to the electronics bay in the Baseline Aircraft. 

• All autopilot and yaw damper actuators are replaced by the primary FBW actuators. 

• Because insufficient definition was available and data buses are used for all signal 
communication, a wiring weight estimate was not included. 

The cost-of-ownership parameters in Table 73 were based on estimates of line replaceable 
unit (LRU) cost, weight, and maintenance cost for the 1990s time frame. Computer 
analysis showed some significant differences from the Selected System, which are 
discussed as follows: 

• Incremental Airplane Cost — Most of the cost reduction is due to the deletion of the 
thousands of parts inherent in the mechanical transmission of pilot’s control signals. 
Deleting all autopilot actuators also contributes. 

• Maintenance Manual Cost — This cost was estimated differently than the Selected 
System cost. Total cost of developing and printing maintenance manuals was 
estimated to be $547 000. Cost for a 30-aircraft fleet was determined by dividing 
the total cost by the estimated production run of 300 airplanes and multiplying by 
30. This cost is more than the Selected System cost (based on typical autopilot cost) 
because of FBW in all axes. Some reduction might be expected from deleting 
mechanical controls, but this has not been considered in this preliminary analysis. 
Maintenance manual cost is, in any case, a low-leverage parameter. 

• Maintenance Cost per Flight Hour — Major reductions here stem from the deletion of 
all mechanical connections between the cockpit and the control surface servos. 
Deletion of all autopilot actuators is a contributor of almost equal importance. 
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Table 73. Cost-of-Ownership Results for Various ACT Systems 


Parameter 

Current technology 

Advanced 

technology 

incremented 

1 ntegrated 

Segregated 

Selected 

Selected + 
pitch FBW 

1990 ACT 

Aircraft purchase cost per aircraft 
(in dollars) 

274K 

390 2K 

297. IK 

207 K 

98.8K 

Maintenance manual cost per 
30-aircraft fleet (in dollars) 

21K 

31.4K 

26. IK 

26 IK 

54.7K 

Test equipment cost per 
30-aircraft fleet (in dollars) 

22.5K 

44 .9 K 

33.6K 

33.6K 

10.0K 

Spare inventory initial cost per 
30-aircraft fleet (in dollars) 

250K 

356K 

271. IK 

271 IK 

221 IK 

Maintenance cost per aircraft 
flight hour (in dollars) 

4.18 

4.91 

4.22 

3.98 

-0.59 

Departure delay and cancellation 
cost per aircraft flight hour (in dollars) 

0.54 

0.45 

0.19 

0.12 

0.54 

Change in system weight 
relative to integrated ACT 

0 

+ 114kg 
(+252 lb) 

+ 14 kg 
(+30 lb) 

-156 kg 
(-345 lb) 

-629 kg 
(-1386 lb) 

Fuel saving per flight hour at 863 km 

(466 nmi) 

160 kg 
(352 lb) 

146 kg 
(322 lb) 

160 kg 
(352 lb) 

172 kg 
(379 lb) 

212 kg 
(468 lb) 

Payback period in years 

2.83 

4.14 

2.98 

2.02 

<2.0 

Incremental return on investment to airline 

25.1% 

22.1% 

24 6% 

27.6% 

34.9% 


• Maintenance manual cost = $547K total, which gives — x 30 = $54. 7K for 30-airplane fleet 


• Departure Delay and Cancellation Cost per Flight Hour — Because inadequate data 
and resources were available to perform a detailed analysis, the 1990 FBW system 
was judged to be the same as the Integrated System, as it is a four-computer 
integrated system. However, FBW in all axes will require careful reliability analysis 
before an acceptable minimum equipment list can be defined and a detailed 
departure reliability predicted. 

• Change in System Weight — This very significant |g 28.7 kg (1386 lb)] weight reduction 
(compared to Integrated) was largely due to the deletion of mechanical flight 
controls, but deletion of all autopilot actuators and lower weight for the FBW 
surface control actuators ^112.9 kg (249 lb)j also contributed. 
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• Fuel Savings per Flight Hour — This significant change is due to the weight savings of 
628.7 kg (1386 lb). 

• Return on Investment and Payback Period — The large improvements for full FBW are 
largely due to the reduction in first cost and fuel burn obtained from weight 
reduction. 


15.0 CONCLUDING REMARKS 


The results to date of the lAAC Project work indicate that the concept of an Active 
Controls Technology (ACT) airplane, designed as such from the beginning, will indeed 
yield an important saving in fuel over a similar commercial transport airplane without 
active controls. The results of the current and advanced technology ACT control system 
work presented in this report indicate that it is feasible to support such an active controls 
airplane with a control system that meets all reliability and availability requirements, 
assuming fault-free software and coverage approaching 1.0. The results also indicate that 
this can be done at a cost that enables a suitable return on investment for the operators. 

The Current Technology ACT Control System Definition Task had two primary objectives. 
The first objective was to define a digital ACT control system architecture, using digital 
flight control system elements currently being used or considered in commercial jet 
transports, that exhibits high reliability and low cost. The second objective was to 
identify the major concerns and unresolved issues relative to the use of such a control 
system. The technical approach was to develop two extreme forms of system 
architecture and then select a system architecture for the ACT control system that uses 
the best features of these extreme forms. The major conclusions of this work are as 
follows: 

• All three of the control systems studied meet the reliability requirements of the 
design requirements and objectives, if software reliability and coverage are assumed 
equal to 1.0. The Segregated System is predicted to be the most reliable, followed 
in order by the Selected and Integrated Systems. 

• The Integrated System, with its single set of redundant digital control computers, is 
the most efficient of the three systems. It satisfies function and reliability 
requirements at the lowest cost. 

• The Segregated System failed to show the expected major improvement in 
reliability. Overall system reliability is principally a multiple-function loss 
probability and is dependent primarily upon the digital air data computers and 
inertial reference systems. 
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• The Segregated System cost is unacceptable, being 30% greater than the Selected 
System cost and 40% greater than the Integrated System cost. Although the 
individual control computers specified for the Segregated System are based upon 
microprocessor technology, the resulting reduction in unit cost, compared to the 
Integrated System computers, is not sufficient to compensate for the large 
number (19) of computers required for the Segregated System. 

• The Selected System shows a decided reliability improvement over the Integrated 
System with a small increase in cost. 

The major concerns that arise from review of these results center around system 
complexity and the ever-present question of system reliability in the operational 
environment. The hardware reliability predictions are based on the assumption of 
software reliability and coverage equal to 1.0. Although the absolute values of the 
resulting reliability predictions may be suspect, their use as one relative figure of merit is 
considered well founded. There is no generally accepted method to prove software 
reliability equal to the required level. However, 15 years of Boeing experience in 
engineering real-time digital control systems has shown that a process that begins with 
careful functional analysis and leads through requirements, design, coding, verification, 
validation, exhaustive testing, configuration control, and careful documentation can 
produce highly reliable real-time control software. Therefore, it is concluded that the 
ACT systems can be implemented using currently available technology and software 
design processes. 

The objectives of the Advanced Technology ACT Control System Definition Task were to 
(1) determine the benefits of synthesizing ACT control laws using optimal control and 
estimation theory, (2) determine the effects of actuation system nonlinearities on gust- 
load alleviation and flutter suppression effectiveness, and (3) identify advanced flight 
control system implementation concepts as an alternative to the current technology 
implementation of ACT control functions. 

The technical approach to the synthesis evaluation objective was to synthesize control 
laws, using these techniques, to equal or exceed the performance of the systems 
synthesized using classical techniques. The actuator nonlinearities were examined by 
introducing representative position and rate limits and output hysteresis into the 
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mathematical model and comparing load reduction in the presence of discrete gusts. The 
alternative implementation objective was met by determining the system components 
(e.g., sensors, computers, actuators, and fiber optics) that would probably be available in 
1990 for use on commercial transports. Using these components, three systems— with 
various risk levels— were formulated to meet the same design requirements and objectives 
that the current technology system was designed to meet. The best of these systems was 
examined further. 

The major conclusions of this work are as follows: 

• The analysis procedures presented in this document offer systematic methods for 
selecting the proper control surfaces, actuation bandwidths, and sensor locations and 
for evaluating open- and closed-loop stability and gust responses for an ACT 
airplane. 

• Design procedures based upon time-domain optimal control theory offer a direct and 
systematic method to derive multiloop control laws that satisfy typical active 
control design requirements. 

• The synthesis procedure using optimal control theory created a pitch-augmented 
stability control law that produced augmented airplane behavior similar to an ideal 
model directly and systematically. 

• The medium-risk 1990 technology ACT system design is a quadruply redundant 
integrated system combined with fly-by-wire (FBW) primary controls in all three 
axes. Its architecture is strongly oriented toward digital buses and multiple 
microprocessors, using quadruple input buses coupling digital sensors to the four 
central control computers and quadruple output buses feeding servoelectronics units 
incorporating digital-to-analog conversion. The resulting predicted system 
reliability is appropriate for an ACT flight control system, even though fault-free 
software and coverage approaching 1.0 were assumed. 

The encouraging results of the control system work, and important unresolved issues, 
emphasize the desirability of proceeding with the planned laboratory tests and flight 
demonstration. Thus the plan is to continue the NASA-Boeing lAAC Project activity 
according to the project plan. 
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